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ABSTRACT 


This research will focus on fusion centers, particularly the expectation of state and 
local fusion centers and their role. How will fusion centers add to the national effort to 
protect the Homeland, while also providing a benefit to their local communities? This 
effort will seek to determine what role the state and local fusion centers should be 
concerned with and how they might add local value. 

With the increasing prevalence of fusion centers it will be important to determine 
how those fusion centers will be used and how they will collect the information that they 
will fuse, or analyze, and turn into an intelligence product. There are several questions 
before fusion centers such as, who are your customers, what is your product, how do you 
collect and analyze your data, how do you get information from emergency responders 
and actionable intelligence back to them? 

If the fusion centers can produce a timely, locally actionable, and relevant product 
to its customers in the form of strategic analysis to policy makers, tactical analysis to 
counter terrorism, tactical analysis to major criminal investigations, and situational 
awareness and reporting mechanisms to the emergency responder community then they 
will have established their value. 
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I. INTRODUCTION 


A. PROBLEM STATEMENT 

State and local fusion centers have emerged in a rather rapid manner throughout 
the country. This is a natural reaction to the unexpected attack of 9/11. Local officials 
wanted more intelligence to prepare them to protect their communities against any such 
unimagined attack in their jurisdiction. Many officials also felt they were not being 
provided sufficient information from the federal intelligence community to protect their 
communities 1 and that some infonnation was being withheld (it has not been 
demonstrated that this information actually exists). 2 However, with the recent influx of 
fusion centers has come a wide range of applications and expectations, and more than a 
little dissatisfaction, with the outcome of the fusion center efforts. 

This thesis will not measure the effectiveness of the fusion centers, but will 
attempt to identify what local value they can provide to state and local jurisdictions and 
how that value may be increased. As the centers are relatively new, there are very few 
performance measures or metrics upon which to measure them. This thesis will simply 
accept the fact that they exist and that a significant amount of resources in time, money 
and personnel have been expended to stand them up. The intent of this thesis is to 
examine how the fusion centers operate and to try to identify whether there are some 
practices that could optimize their value at the state and local level, which will perhaps 
enhance their future value. 

This research will focus on fusion centers, particularly the expectation of state and 
local fusion centers and their role. How will fusion centers add to the national effort to 

1 Normal Beasley, Testimony before the U.S. Maricopa County (Arizona) Sheriff s Office Before the 
U.S. House of Representatives House Committee on Homeland Security Subcommittee on Intelligence, 
Information Sharing and Terrorism Risk Assessment: “The Way Forward with Fusion Centers: Challenges 
and Strategies for Change,” September 27, 2007, 6., https://www.hsdl.org/homesec/docs/testimony/nps33- 
092707-04.pdf&code=7035620d98ed78e74bl36023c2dd3clb. last accessed November 12, 2007. 

2 Todd Masse, Siobhan O'Neill, and John Rollins, CRS report for Congress, Fusion Centers: issues 
and options for Congress, July 6, 2007, order code RL 34070, 28. The report states numerous officials 
complained about not getting the “right” information the report footnotes identify this is a possible 
perception issue on the limits of national intelligence. 
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protect the homeland and at the same time provide a benefit to their local communities? 
Is replicating the federal model the best course of action for state and local fusion centers, 
or is there an alternative? This effort will seek to detennine what role the state and local 
fusion centers should be concerned with, and how they might add local value to the 
process. 

With the ever-increasing prevalence of fusion centers, it will be important to 
determine how those fusion centers will be used and how they will collect the 
information that they will fuse, or analyze, and turn into an intelligence product. There 
are several questions before fusion centers such as: Who are your customers, what is your 
product, and how do you collect and analyze your data? Another central issue before the 
fusion centers is how they get infonnation from emergency responders and actionable 
intelligence back to them. There are many references to utilizing emergency responders 
as intelligence gatherers. What is missing, however, are direct citations or models as to 
how these emergency responders are utilized to collect information and relay that 
information to the fusion center. 

There are also frequent references to community-oriented policing and, to a lesser 
extent, to Terrorism Liaison Officers (TLO). Again, the proponents are conspicuously 
vague as to how to enact or implement a program that will successfully engage 
emergency responders. Nor are there any widely distributed reported successes by 
community-oriented policing efforts in interdicting foreign or domestic terrorism. 
Admittedly, some successes may go unreported or undiscovered. 

A further problem with the regional fusion centers and infonnation collection is 
that there is, more often than not, insufficient purely “terrorist” activity to support a 
multi-jurisdictional and multi-governmental level fusion center that exclusively processes 
tenorist activity. If a fusion center (outside of perhaps NY, LA or DC) were to rely 
solely on terrorist data to process, I would argue the analysts’ skills would atrophy, as 
would their interest, from a lack of relevant work. Additionally, due to the paucity of 
strictly terrorist infonnation, the emergency responder community would soon forget the 
how or why of reporting information to the fusion center, regardless of any marketing or 
promotional campaigns to gamer interest and participation. Fusion centers must consider 
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analyzing or processing other criminal activity, in addition to terrorist activity, in order to 
maintain the skills and interest of the analysts, as well as the participation and data 
collection of the emergency responder community. 

The Sacramento Regional Terrorism Threat Assessment Center (RTTAC) has 
responsibility for thirty-four counties in California and has trained hundreds of TLO 
officers in its TLO program. At the time this project was started, early 2007, the RTTAC 
had received very limited information, leads, or tips from the TLO officers, and even less 
from the emergency responder community as a whole (one year later, the tips and leads 
have increased, due to an aggressive TLO campaign, but are still far short of what is 
hoped for). 3 That lack of anticipated response begs the question of “why?” Are other 
agencies having the same lack of response? It is my suspicion that many fusion centers 
have the same problem as Sacramento in collecting infonnation from not only the law 
enforcement rank and file, but from the other emergency responder disciplines as well. 

B. RESEARCH QUESTION 

Fusion centers are getting a lot of attention right now, and deservedly so, as a step 
in the right direction for information and intelligence integration between federal, state, 
and local agencies. However, they may be missing out on an opportunity to capitalize on 
a largely untapped data source by failing to aggressively engage emergency and front-line 
responders to collect and forward potentially helpful information. Information that would 
be particularly useful in detecting and deterring domestically generated terrorist plots. 

The research questions I will be asking are: 

1) What is the mission of the state and local fusion centers? Do they have a national 

value? Do they have a local value? 

2) What can be done to improve the effectiveness of state and local fusion centers? 

My research will address the following issues as well: 


3 Lt. Tim Johnstone, Sacramento County Sheriff s Department, RTTAC Commander, personal 
communication, 2007. 


3 



1) How do we enhance our local data collection capabilities? Are we effectively 
getting intelligence/information from the emergency responders to the fusion centers? 

2) Is it beneficial for the maximum effectiveness of fusion centers to have a conduit 
from regional front-line responders to the center itself? If so, how can we streamline the 
process to get usable information to the front-line responders, actionable intelligence to 
the law enforcement operations and how do we get the infonnation from the front-line 
responders to the fusion center? 

C. SPECIFIC RESEARCH OBJECTIVE 

The specific research objective is to identify effective methods for fusion centers 
to operate so as to provide value to the national effort to protect the homeland and the 
local effort to protect their citizens; and, to determine how or if the use of locally 
collected infonnation produced by or facilitated by emergency responders will materially 
assist in that effort. 

D. SIGNIFICANCE OF RESEARCH 

• Literature: the significance of this research will prove the viability of 
fusion centers by utilizing local information collection methods and 
producing localized, timely and relevant intelligence. Little has been 
written in this area and this thesis will add to the existing body of work. 

• Future research efforts: future research efforts would include 
conoboration of thesis’ findings and extensions of these concepts into 
other communities and professions. Future research efforts to measure the 
effectiveness of fusions centers should be done once they have had 
sufficient time to mature and perfonnance metrics can be established. 
Additional future research efforts should be done after an assessment of 
any gaps or shortcomings associated with this thesis or conclusions that 
are later found to be not supported or require further review. 
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• Immediate consumer: immediate consumer for this thesis would be the 
Sacramento Regional Terrorism Threat Center, the Sacramento Regional 
Office of Homeland Security and the Sacramento Terrorism Liaison 
Officer program. 

• HS practitioners: it is the anticipation and hope that any information or 
recommendations derived from this thesis would be useful not only to the 
Sacramento Regional Office of Homeland Security, but to any other 
regional organizations engaged in the collection and dissemination of 
information and intelligence in terrorist/criminal activities. 

E. REVIEW OF RELEVANT LITERATURE 

1. Fusion Centers 

Fusion centers have begun to spread throughout the nation as an emergent 
response to a need for more local intelligence by regional responder communities. In 
response to this perceived need, state and local entities began to create their own fusion 
centers in an attempt to gain infonnation that they felt that they were not getting from the 
federal government. 

The United States Department of Justice and the Department of Homeland 
Security (DHS) have defined fusion centers as: "a collaborative effort of two or more 
agencies that provide resources, expertise, and/or information to the center with the goal 
of maximizing the ability to detect, prevent, investigate, apprehend, and respond to 
criminal and terrorist activity." 4 The federal government recognized the potential benefit 
to not only the state and local entities, but to the federal government as well. It has 
facilitated the development of local and state fusion centers by providing funding, 
resource augmentation and technical support. 


4 Fusion Center Guidelines, Developing and Sharing Information and Intelligence In a New Era, 
United States Department Justice, United States Department of Homeland Security, 2006, 12. 
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a. Funding 

The federal government, through the DHS, has been very supportive of 
fusion centers and has provided a great deal of funding for this effort. Unfortunately, 
there are mixed reviews on the level of funding support, and the effectiveness of the 
funds being expended for the value of return or return on investment. In his keynote 
address to the 2007 National Fusion Center Conference, DHS Secretary Chertoff said that 
fusion center funding should not be seen as sustainment, “we are not signing up to fund 
fusion centers in perpetuity,” and that the centers will have to look to local support for 
continued funding. This will necessitate recognition by local officials of a local value for 
these centers to gain needed financial support. 5 

The need for funding to sustain the fusion centers is highlighted in the 
National Criminal Intelligence Sharing Plan (NCISP), which states, "Without adequate 
funding, many of the recommendations, including improved training and technical 
infrastructure, will not implemented, and the country will remain at risk.” The same 
recommendation calls for a petition to Congress for financial support. 6 The need for an 
identified and long-term funding is highlighted by the GAO report, Homeland Security, 
Federal Efforts are Helping to Alleviate Some Challenges Encountered by State and 
Local Information Fusion Centers. The report states that fifty-four of the fifty-eight 
fusion centers reported challenges in obtaining and maintaining funding. Grant 
administration restrictions on fusion centers, in addition to navigating the grant system, 
were cited as a problem. The report also called on the Information Sharing Environment 
plans to rely on a nationwide network of state and local fusion centers, but no long-term 
funding for such an undertaking has been identified. This lack of commitment is making 
it hard on local efforts to commit fully to the fusion center concept. 7 


5 Derived from transcript of Secretary Chertoff s address, as referenced by the CRS report by Masse et 
ah, CRS report for Congress, 44. 

6 The National Criminal Intelligence Sharing Plan, U. S. Department of Justice, Bureau of Justice 
Assistance and Global Justice Information Sharing Initiative, October 2003, 11-12. 

7 Homeland Security, Federal Efforts are Helping to Alleviate Some Challenges Encountered by State 
and Local Information Fusion Centers, United States Government Accountability Office, GAO-08-35, 
October 2007, 7-8. 
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In contrast, the joint publication by the Departments of Justice and 
Homeland Security report, Fusion Center Guidelines, Developing and Sharing 
Information and Intelligence in a New Era (FCG), specifically places responsibility on 
local centers’ administration to seek out funding sources for long-term continuity. 8 

Matt Bettenhausen, Director of the California State Office of Homeland 
Security, identified the lack of sustained funding as the biggest obstacle to the continuing 
operation of state and local fusion centers. He argues that counterterrorism has always, 
first and foremost, been a federal obligation, and that the state and local fusion centers 
enhance that mission in a material way. His position is that sustained funding for fusion 
centers is a minor cost with a significant potential benefit. 9 

b. Resource Augmentation 

The federal government resource augmentation for fusion centers has 
come primarily from two agencies, the FBI and the DHS. The FBI has provided support 
to the fusion center effort by co-locating staff in the fusion centers, facilitating the 
security clearance process and assisting in rent payments in joint occupancy fusion 
centers. 10 

As an example of the support and the growing importance of fusion 
centers, the DHS, in addition to providing direct support in the form of grant dollars, is 
committing to putting a DHS analyst in all state and local fusion centers. 11 Participation 
in the fusion center process assists local government policy makers and those responsible 
for the protection of the community with not only pertinent intelligence with a local 
application; it provides an opportunity to develop networks and relationships that will be 
critical in any future catastrophic event. This concept was a central theme in the 
Improving Information report from LEAP: 


8 Fusion Center Guidelines, 63. 

9 Matt Bettenhausen, Director, California Office of Homeland Security, Interview, January 3, 2008. 

10 Masse et al., CRS report for Congress, 38. 

11 Charles Allen, DHS Director of Intelligence, Testimony before Senate Select Committee, 
September 7, 2006. 
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State, local, and tribal law enforcement participation in state and local 
fusion centers advances the cause of intelligence-led policing by involving 
officers in the intelligence process on a daily basis; helping them build 
relationships across every level and discipline of government and the 
private sector; and ensuring that law enforcement intelligence and other 
information is shared with their home communities. 12 

Fusion centers emerged almost spontaneously in response to a need by 
state and local law enforcement for useful and usable intelligence related to the evolving 
terrorist threat. This position was reinforced when Norman Beasley testified before the 
House of Representatives: 

One of the chief complaints of state and local officials is the lack of 
actionable information from the National Intelligence Community. This is 
exactly why state/local fusion centers were implemented. 13 

c. Technical Support 

The fusion centers started independently and spontaneously with little 
regard for standardization, intelligence collection and production methods, analytical 
production requirements, analytical staff training, roles and responsibilities, or a defined 
mission. Further, there is little integration or infonnation sharing from one fusion center 
to another. The goals of the fusion centers, as stated in the CRS report summary, is that 
the various strains of information flowing into the fusion center need to be "translated 
into protective action." 14 

Historically, local law enforcement has had very little, if any, influence or 
role in the intelligence community. What little influence or participation the law 
enforcement community has had is in the form of the federal law enforcement 
community, principally, the Federal Bureau of Investigation. Absent that, there has been 


12 A Law Enforcement Assistance and Partnership Strategy, Improving Information Sharing between 
the Intelligence Community and State, Local, and Tribal Law Enforcement, 2, 
http://epic.org/privacy/fi.ision/leap.pdf . Last accessed February 29, 2008. 

13 Beasley, Testimony before the U.S. Maricopa County (Arizona) Sheriff s Office. 

14 Masse et ah, CRS report for Congress, summary page. 
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very limited involvement by state or local law enforcement in the intelligence collection, 
analysis, or production for counterterrorist activity. 

The staff that the FBI and DHS have assigned to the state and local fusion 
centers, in addition to being a resource augmentation, is a significant form a technical 
assistance. The FBI is also using its senior analysts to train the local analysts, and they 
are using their staff to provide assistance and guidance in the development of the fusion 
process at the centers . 15 While conducting the research for this thesis, several people 
throughout the Sate of California and outside of California were interviewed, on and off 
the record. There was not one person who had any relevant association with fusion 
centers who was not wholly and completely pleased with the FBI’s commitment to state 
and local fusion centers. No one felt excluded or anything less than a full partner. All 
four of the California FBI field offices have clearly embraced the “information sharing 
environment” and have been instrumental in assisting state and local fusion centers in 
their development. The DHS Intelligence and Analysis staff detailed to the fusion centers 
were also well regarded, although they are much newer to the centers and there are far 
fewer of them than the FBI resources. 

The federal government has also produced several reports and documents 
to help guide the development and professionalism of the fusions centers. A sample of 
these reports include the National Criminal Intelligence Sharing Plan and the Fusion 
Center Guidelines, Developing and Sharing Infonnation and Intelligence in a New Era. 

The Department of Homeland Security is taking several steps to address 
the lack of standardization, uniformity, mission and training, in addition to providing on¬ 
site staff to assist in the development of the centers. The DHS has created seven different 
technical assistance programs that respond directly to these identified shortcomings and 
has addressed the issue in national conferences . 16 


15 Masse et al., CRS report for Congress, 38. 

16 DHS Fusion Center Conference, Washington, DC, September 2007, and the LEAD ACT 
Conference Quantico, VA, August 2007; personal communication, Lt Tim Johnstone, September 27, 2007. 
See also Masse et ah, CRS report for Congress, Fusion Centers: 41. Additionally DHS has funded a three- 
million-dollar grant to provide standardized training to fusion analysts, which was awarded to the 
Sacramento Region in 2007. 
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The FBI and DHS have also made available their classified databases to 
trained and qualified (cleared) personnel. In addition, both agencies have made efforts to 
increase the number of clearances to local and state personnel but are taking steps to 
improve the process. Even with the support that the federal government has given fusion 
centers there are issues or obstacles that remain before state and local fusion centers can 
be as productive and relevant as had been anticipated. 

d. Fusion Process 

The fusion process, as described by the Fusion Center Guidelines, 
Developing and Sharing Information and Intelligence in a New Era (FCG), is a six-stage 
process. The FCG based their to fusion process on the Homeland Security Advisory 
Council’s (HSAC) Intelligence and Information Sharing Initiative: Homeland Security 
Intelligence and Information Fusion. The process in the FCG is described as: 

• the first stage, management and governance, establishes the foundation of 
the fusion center 

• the second stage, planning and requirements, establishes what type of 
information will be collected 

• the third stage, collection, is the actual collection of information from a 
variety of sources 

• the fourth stage, analysis, is where information is turned into actionable 
intelligence 

• the fifth stage, dissemination, tasking and archiving, is where information 
is disseminated to stakeholders 

• the sixth stage is reevaluation, where the fusion center and stakeholders 
ensure that what is being collected, analyzed and disseminated is factual, 
timely and relevant 

• the seventh stage is modification where, if there are changes during the 
reevaluation, they are implemented here 17 


17 Fusion Center Guidelines, 20-21. 
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The intelligence cycle has a generally accepted process with a few 
modifications or variances from entity to entity. A generally accepted model is presented 
below from Mark Lowenthal's (Lowenthal is a recognized expert cited by the CRS) book 
Intelligence from Secrets to Policy. 

This process is often accepted to consist of: 

• requirements, which is an identification of need and priority, long term 
and immediate 

• collection, which is the method, amount and source of infonnation 

• processing and exploitation, which is a process of rendering technical data 
into usable fonnat 

• analysis and production, which is the process of analysis and the creation 
of the written product 

• dissemination and consumption, which is the distribution and assimilation 
of the product 

• feedback, which is infonnation from the policymakers concerning how 
effective the product fits their needs. 18 

These two processes are very similar but there are two subtle distinctions 
that potentially become issues. The first is the dissemination step in the Fusion Center 
Guidelines. In Lowenthal’s book, he identifies this step as dissemination and 
consumption. It is not enough to get the product to the proper consumers, it must come in 
a form that will be used and assimilated. The second is what the Fusion Center 
Guidelines refer to as the reevaluation step, which is basically for accuracy and 
relevance; whereas, in Lownethal’s model, he identifies a feedback step, which is 
ostensibly analogous to the reevaluation step. However, the feedback step clearly 
articulates the need to have the final consumer provide input on the usefulness of the 
product. 


18 Mark M. Lowenthal, Intelligence, From Secrets to Policy , Washington, DC: CQ Press, 2006, 54-67; 
this is a synopsis of the intelligence cycle as described in this work. 
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e. Administration 

The Fusion Center Guideline number three recommends that each fusion 
center establish a governance board comprised of high-level officials from law 
enforcement, public safety and the private sector. One of the relevant issues for 
consideration is that a governance board should ensure “defining the management 
structure to include what entity oversees the centers, manages the operations, and 
coordinates daily activities.” 19 There are no recommendations as to what that 
management structure should look like. 

The literature is very weak or silent on the issue of who should lead fusion 
centers. The BJA guidelines state that fusion centers should have a governance board of 
some type but they do not get into the nuances of actual leadership. The NCISP states, in 
the first recommendation, that the agency chief executive officer and the manager of 
intelligence functions should define the management and supervision of the center. This 
concept is virtually covered in a bullet point. 20 

f Mission 

The mission of each fusion center should be something directly related to 
the center’s intended goals. What will be as, or more, important as the mission, is how, 
or by what process, that mission is derived. The FCG list several issues for consideration 
such as: developing the mission statement in a collaborative process; identifying the 
center customers and their needs, and defining center priorities prior to drafting the 
mission statement; and, prioritize the intelligence function to address threats in the local 
jurisdictions. 21 

The California State Terrorism Threat Assessment System, comprised of 
the State Terrorist Threat Assessment Center (STTAC) and the four Regional Terrorist 
Threat Assessment Centers (RTTAC), collaborated on a concept of operations plan as a 

19 Fusion Center Guidelines, 25. 

20 The National Criminal Intelligence Sharing Plan, U. S. Department of Justice, Bureau of Justice 
Assistance and Global Justice information Sharing Initiative, October 2003, 10. 

21 Fusion Center Guidelines, 23. 
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guiding principle for all five of the threat assessment centers, which also function as 
fusion centers. As part of that concept of operations, a mission statement and a vision 
statement is included. The mission statement is: 

The mission of the state terrorism threat assessment system is to foster a 
collaborative effort to collect and analyze criminal infonnation, employ 
cutting-edge analytical tools and methodologies to produce and share 
timely and actionable Homeland Security intelligence, thereby enhancing 
the safety of the citizens of California. 22 

g. All Crime Vs Strictly Counterterrorism 

The vast majority of fusion centers, however, have taken an all-crimes 
approach to fusion analysis within their jurisdictions (all crimes rarely means “all 
crimes,” but is usually meant to be certain organized crimes or major crimes such as 
narcotics, crimes of violence and gangs, or crimes that may be used to support terrorism 
efforts here or abroad such as financial crimes or fraud. Strictly counterterrorism is meant 
to be, for this thesis, crimes that are terrorist acts or those in which the association to 
terrorism is apparent at face value). The CRS report for Congress, Fusion Centers: 
Issues and Options for Congress, reported that less than 15 percent of current fusion 
centers operate with a solely counterterrorism posture. The report identified some of the 
reasons for this as a national trend, need for local and non-law enforcement buy-in, and 
the need for resources 23 The same report also stated that “most police departments and 
public sector agencies are more concerned with issues such as gangs, narcotics, and street 
crime, which are more relevant to their communities.” 24 

A GAO report published in October 2007 also reported the vast majority 
of fusion centers — forty-one of the forty-three that were contacted — stated that they 
operated as “broader than solely focusing on counterterrorism.” Twenty-two of the 
center officials stated they included criminal activity in their mission, and nineteen said 

22 Strategic Business Plan Concept of Operations, California State Terrorism Threat Assessment 
System, nd, 3. 

23 Masse et al., CRS report for Congress, 21. 

24 Ibid. 
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they included an all-hazards focus in addition to counterterrorism. It was unclear whether 
the all-hazards fusion centers included a criminal perspective as well. The reasons cited 
for including the criminal mission were basically the position that there is a nexus 
between criminal conduct and terrorist behavior, and that one may uncover the other. A 
second reason cited was to gain more support and stakeholders such as law 
enforcement. 25 


h. Strategic Vs Tactical Analysis 

The fact that these terms need to be defined underscores a large problem 
with fusion centers and their mission. There is no commonly understood and universally 
accepted definition for the term strategic analysis or tactical analysis. As described by a 
career intelligence analyst, the absence of an accepted term is “part of the problem.” This 
analyst prefers the tenn “all source analyst” over “true” intelligence analyst when 
referring to strategic analysis as the tenn “true” can be unintentionally pejorative. 26 For 
the purposes of this thesis, strategic analysis is analysis of disparate data sources, 
identification of intelligence gaps, pro-active collection of intelligence, and predicative 
analysis of an act or occurrence with recommendations or sufficient substance to guide 
policy. The strategic analyst must rely on his or her expertise and thorough knowledge of 
their respective domain to fill knowledge gaps. Tactical analysis is research and analysis 
on events that have already occurred and are not predictive; it is predominantly 
investigative case support or an analytical assessment of a variety of data inputs. 

David Carter, in his book Law Enforcement Intelligence: a Guide for 
State, Local, and Tribal Law Enforcement Agencies, offers a definition for strategic and 
tactical law enforcement intelligence. He describes strategic as having a planning and 
resource allocation function that provides infonnation to decision makers about the 
changing nature of threats and the characteristics and methodologies of threats for the 

25 Homeland Security, “Federal Efforts are Helping to Alleviate Some Challenges Encountered by 
State and Local Information Fusion Centers,” United States Government Accountability Office, GAO-08- 
35, October 2007, 18-19. 

26 Personal communication, with a confidential source who is a career intelligence analyst, February 
22, 2008. 
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purpose of developing response strategies and resource allocation. Tactical intelligence 
is described as having a preventive function to gain infonnation to apprehend offenders, 
harden targets, and use strategies that will eliminate or mitigate the threat. 27 


Both the National Criminal Intelligence Sharing Plan and the Fusion 
Center Guidelines, Developing and Sharing Information and Intelligence in a New Era, 
skirt the distinction between tactical and strategic analysts and do not offer a definition of 
the two entities. The Fusion Center Guidelines make a recommendation that a center 
provide both tactical and strategic products. The Fusion Center Guidelines recommend 
that the center should have a strategic capability as well as a tactical capability and that 
intelligence functions should prioritize their efforts based on threats specific to the 
center’s area of concern. 28 

The majority of fusion centers operate exclusively in an analytical 
capacity rather than as having any response or operational capacity. Those few fusion 
centers that do have a response capability were generally found to be fusion centers that 
were state-controlled, single entity, and largely staffed by law enforcement personnel. 
The scope of analysis that the fusion centers focus their efforts on has a great range of 
variability. Again, the majority of fusion centers that conducted their analysis for the 
purposes of prevention considered their responsibilities to be information sharing, 
assessments and analysis, and to facilitate preparedness efforts. 

To accomplish this, fusion centers operate as “filtering stations” to pass 
along information, but some fusion centers add local information to enhance the product. 
Some fusion centers added analytic value while others provided case support to law 
enforcement agencies. None of the fusion centers appeared to be using all of the steps in 
the intelligence cycle 29 


27 David L. Carter, Law Enforcement Intelligence: a Guide for State, Local, and Tribal Law 
Enforcement Agencies, U.S. Department of Justice, Office of Community Oriented Policing, Cooperative 
Agreement #2003-CK-WX-0455, November 2004, 8. 

28 Fusion Center Guidelines, 57. 

29 Masse et al., CRS report for Congress, Fusion Centers: 23-24. 
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i. Analysts 


The Fusion Center Guidelines, in guideline number eleven, recommend 
hiring staff that can perform both tactical and strategic analytical functions. Under 
“issues for consideration” of the same guideline, the report recommends that 
consideration be given to establishing a permanent, full-time civilian presence to provide 
continuity and consistency. The guideline also recommends requiring a minimum term 
commitment for full-time personnel and recommends that the center obtain the 
appropriate clearance requirements as needed for staff to do their job. 30 

The NCISP stated that there is a need to develop standards of training, not 
only for the analysts and those assigned to the fusion center, but also for those who are 
associated with it. In fact, the NCISP recommended minimum training standards in its 
recommendation section. The NCISP has highlighted the need for the analytical function 
of the fusion centers to follow the intelligence cycle and, further, it calls for "appropriate 
training for all personnel assigned to or impacted by the intelligence process." 31 The 
NCISP established a six-level intelligence training standard: level 1 is for law 
enforcement officers; level 2 is for law enforcement executives; level 3 is for intelligence 
commanders/supervisors; level 4 is for intelligence officers/collectors; level 5 is for 
intelligence analysts; and, level 6 is for train the trainer. 

Level 5 training objectives, are in part: the intelligence process; handling 
of criminal intelligence information; critical thinking and inference development; 
collection and analytical plans; legal, privacy and ethical issues; research methods; and 
methodologies of analysis. The standard requires a minimum of forty hours of training 
that should be delivered in a classroom environment. 32 The NCISP further supports the 
need for standardized training, calling for the IALEIA to develop minimum standards for 
analysts in recommendation number twelve. 


30 Fusion Center Guidelines, 51. 

31 The National Criminal Intelligence Sharing Plan, 10. 

32 Ibid., 39. 
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Dissemination 


Dissemination of any intelligence product is quite possibly the most 
critical piece of the process, but one that can easily be overlooked by assuming “it” will 
just happen. According to the NCISP, "dissemination is also a vital step in the process. 
Without disseminating intelligence developed it is pointless to collect it. The intelligence 
disseminated must be timely and credible to be useful." 33 It was further recommended, 
as part of recommendation number one, that all fusion centers "implement a 
method/system for dissemination of information to appropriate components/entities." 34 

The topic of dissemination has had several different authorities weigh in 
on the topic such as the following quote from Intelligence-Led Policing: The New 
Intelligence Architecture: "Information sharing must become a policy, not an informal 
practice. Most important, intelligence must be contingent on quality analysis of data." 35 
Probably the most authoritative citation comes from the 9/11 Commission Report : “The 
biggest impediment to all-source analysis — to a greater likelihood of connecting the 
dots — is the human or systemic resistance to sharing information.” 36 

Dissemination of information and intelligence product is not only an 
extremely necessary part of the intelligence process, it is also one that is not without 
controversy. One area of potential conflict is the level at which different emergency 
responder groups should receive information. One of the few resources to address this 
directly is the Fusion Center Guidelines released in August of 2006, which states that, 
even though fusion centers will have many different partners, not all partners need nor 
should receive dissemination of information and intelligence at the same level, stating 
"each discipline will not need the same level of detail.” 37 


33 The National Criminal Intelligence Sharing Plan, 7. 

34 Ibid., 10-11. 

35 U.S. Department of Justice, Intelligence-Led Policing: The New Intelligence Architecture. U.S. DOJ 
website, www.ojp.usdoi.gov , September 2005, viii. 

36 The 9/11 Commission Report: Final Report of the National Commission of Terrorist Attacks Upon 
the United States, 416. 

37 Fusion Center Guidelines, 14. 
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2 . 


Data Collection 


A great deal of support, politically and financially, has been directed toward the 
fusion center concept; it is not only prudent but an obligation to make every effort to 
maximize our opportunities for success. The tremendous expenditure, in both money and 
resources that have been put into fusion centers, begs the question: How do we maximize 
the value of fusion centers? Many have made the proposition that law enforcement and 
the emergency responder community as a whole can make a significant contribution to 
protecting the homeland by becoming a source for information collection. 

It has been widely held and acknowledged that America’s emergency responders 
have a great capacity for interacting with the public they serve — much more intimately 
than their federal counterparts. What has been less well understood, until recently, is 
their potential for contribution to the counterterrorism effort. This point is concisely 
illustrated in the Markle report: 

Most of the real frontlines of homeland security are outside of Washington 
D.C. Likely terrorists are often encountered, and the targets they might 
attack are protected, by local officials — a cop hearing a complaint from a 
landlord, an airport official who hears about a plane some pilot trainee left 
on the runway, an FBI agent puzzled by an odd flight school student in 
Arizona, or an emergency room resident trying to treat patients stricken by 
an unusual illness. 38 

Maximizing our opportunity for a successful interdiction of a terrorist plot may 
well lie in making better use of the large number of emergency responders with close ties 
and information links to their communities. Brian Jenkins made the point in his seminal 
work, Unconquerable Nation. 

Clearly, we need to enhance the intelligence capabilities of local police, 
not just those of the FBI. The more than 600,000 sworn police officers in 
the United States are in the best position to monitor potential homegrown 
terrorists. An entire terrorist plot may proceed under the radar of national 


38 Markle Foundation Task Force, “Protecting America’s Freedom in The Information Age: A Report 
of the Markle Foundation Task Force” (New York, New York, October 2002), 10. 
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intelligence services. Therefore, it is necessary to enhance domestic 
intelligence collection and analysis capabilities. 39 

Equally important to the sheer numbers of emergency responders is the 
knowledge of the “beat” or area they work and their developed ability to see the 
abnonnal. Je nk ins reflects on this idea as well: 

They know their territory. Recruited locally, they are likely to be 
ethnically closer to the communities they serve, they are more aware of 
local changes, and they are more acceptable to local community leaders. 

Unlike federal agents, local police do not rotate to another city every few 
years. They are in the best position to identify “hot spots” for terrorist 
recruiting, talk to local merchants and community leaders, and develop 
local sources of intelligence. As we have seen in many cases, local police, 
through routine criminal investigations, community policing, or dedicated 
intelligence efforts, may be the first to pick up leads to terrorist plots. 40 

A great deal has been written about fusion centers and the need to involve our 
emergency responder community, particularly law enforcement. Much less has been 
written about how we are actually going to engage this community of responders. The 
CRS report on Homeland Security Intelligence reinforces this point when it states that the 
need for equal information sharing is critical between federal and local partners but: 

Yet such an approach also implies a level of information sharing between 
federal, state, local, tribal, and private sector information collection 
entities that does not appear to exist currently. 41 

The value of information coming from the emergency responder (ER) 
community, or as would be identified by the CRS report — nontraditional source data — 
is illustrated by the fact that the CRS report lists as one of the four fusion center value 
propositions: 


39 Brian Jenkins, An Unconquerable Nation (Santa Monica, CA: RAND Corporation, 2006). 164. 

40 Ibid., 166. 

41 See National Governor’s Association, Center for Best Practices, 2006 State Homeland Security 
Directors Survey, April 3, 2006, as reported in Masse et al., CRS Report for Congress, “HLS Intelligence: 
Perceptions, Statutory Definitions, and Approaches,” August 18, 2006, 17-18. 
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State, local and tribal law enforcement and public-sector agencies are in a unique 
position to make observations and collect information that may be central to the type of 
threat assessment referenced above [comprehensive threat picture]. 42 

However, as important as getting infonnation from the local ER community, or 
the nontraditional source data, to the fusion center has been identified, it remains an 
elusive objective at many locations, and in any substantial way. This is supported by the 
CRS report "moreover, the development of a process for gathering infonnation according 
to clearly defined information requirements and fusion centers remains nascent." 43 

One method of field data collection that is being used with some degree of 
positive results is the Tenorism Liaison Officer (TLO) program. There has not, as yet, 
been very much scholarly research conducted on TLOs; however, the program will be 
reported on later in this thesis. 

a. Community-Oriented Policing (COP) 

COP has evolved over the past twenty years and has many different 
definitions and applications. The COP and Problem Solving division of the California 
Attorney General's Office defines COP as: "philosophy, management style, and 
organizational design that promotes proactive problem-solving and police-community 
partnerships to address the causes of crime and fear as well as other community issues." 44 
This philosophy, as espoused by the Attorney General’s office, places great emphasis on 
problem-solving and community partnerships with the philosophy of the supportive law 
enforcement management. 

Scheider and Chapman offer an efficient definition of COP: 

There is no one commonly recognized definition of community policing. 

Here we offer one possible definition that we will then apply to preventing 

and responding to terrorist events. Community policing can be defined as 

42 Masse et at., CRS report for Congress, 4. 

43 Ibid., 5. 

44 Community Oriented Policing and Problem Solving, Definitions and Principles, California Attorney 
General's office, 1999, 3. 
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a philosophy that, through the delivery of police services, focuses on 
crime and social disorder; the philosophy includes aspects of traditional 
law enforcement as well as prevention, problem-solving tactics, and 
partnerships. 45 

Scheider and Chapman also make a concise and accurate assessment of 
the COP philosophy, which they describe as having three interrelated elements of: 
"organizational change, problem-solving, and external partnerships." 46 A new 
organizational structure will help the rank-and-file officers if it allows them the freedom 
to take self-initiated activity and act on their observations of potentially suspicious 
behavior. Acting on the officers’ developed powers of observation for what is “not 
right,” enhanced with awareness level training, will ultimately lead to increased 
investigative tips and leads. Problem solving, which was the forerunner of COP and a 
cornerstone of the tactical effectiveness of COP, has helped both line-level officer and 
detectives to think more analytically, with an end toward finding a solution to a problem, 
rather than making a short-term fix with an arrest. 

While problem solving yielded the greatest tactical benefits, fonning 
external relationships forged huge inroads in establishing links with the community. The 
public relations capital and support for law enforcement was unprecedented. How do we 
trade on the community capital of good will created by COP, and how do we make that 
work in the collection of information useful to counter terrorist action? 

What is the role of community-oriented policing in homeland security and 
the prevention of domestic terrorism? Docobo presented this question in his article 
Community Policing as the Primary Process and Strategy for Homeland Security at the 
Local Law Enforcement Level by stating: "while some have suggested that community 
policing fit into the overall national strategy for homeland security, little research 
specifically identifies community policing strategies and their direct application to the 


45 Matthew C. Scheider, and Robert Chapman, “Community Policing and Terrorism,” retrieved from 
http://www.homelandsecurity.org/journal/articles/Scheider-Chapman.html, April 2003, last retrieved 
September 27, 2007, 2. 

46 Ibid., 1. 
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national strategy for homeland security." 47 Many are fond of saying that COP is a 
valuable tool in counterterrorism but few have made the case. 


b. Hypothesis 

If no action is taken to assist fusion centers in producing locally relevant 
intelligence products, they will eventually lose support from the local law enforcement 
community, which will ultimately negatively affect the value of their product. This will, 
in turn, create even more funding challenges to continue federal support for the fusion 
centers. If the intelligence product produced by the local fusion centers is not locally 
actionable, the fusion centers will be relegated to being little more than local mouthpieces 
for generic, federally produced trends. 

It is anticipated that this would create a loss of support from the 
sponsoring agencies, of which the majority are state and local law enforcement agencies. 
If the fusion centers prove themselves to be less than full and valued members of the 
intelligence community, the partnerships established in the fusion centers will likely 
break apart, unwilling to expend valuable resources with little return. The multi-agency 
and multi-levels of governments that are currently participating will re-allocate their 
resources, relegating the host agency to a crime analysis center rather than an intelligence 
fusion center. This distinction would render their counterterrorist potential moot, 
particularly if the FBI were to disengage. 

c. Methodology and Resources 

The methodology for this thesis is a program of evaluation, utilizing a 
formative approach to review, evaluate, and suggest improvements for fusion centers and 
TLO programs in general and the Sacramento region in particular. The questions were: 
what are the strengths and weaknesses of fusion centers, particularly those associated 


47 Jose Docobo, “Community Policing as the Primary Prevention Strategy for Homeland Security at 
the Local Law Enforcement Level, ” Homeland Security Affairs 1, no. 1, summer 2005, 3. 


22 



with the California State Terrorism Threat Assessment System, as well as other existing 
programs and, just as importantly, what can be done to improve those programs? 
My methodology will be as outlined below. 

Much of the analysis portion of this thesis will focus on the California 
State Terrorism Threat Assessment System, which consists of the State Terrorism Threat 
Assessment Center (STTAC) and the four regional terrorism threat assessment centers 
(RTTAC). The four RTTACs are the Northern California RTTAC located in the San 
Francisco Bay Area, the Sacramento RTTAC, the Los Angeles RTTAC and the San 
Diego RTTAC. The four RTTACs are geographically aligned with the FBI field offices 
and, consequently, the U.S. Attorney's office. 

d. Literature Review 

The first step of the methodology for this thesis will be to continue the 
literature review. Specifically, the research will continue to investigate, in greater depth 
and on a broader range, what variety of intelligence collection methods are being used by 
what agencies, and in what capacity and with what degree of success. Further, review 
will focus on fusion centers and their local or regional operational procedures as well as 
their intelligence production, examining the end product and its regional application, and 
the relevant usefulness of this infonnation to the local emergency responder community 
and administrators. The research will cover anything relating to fusion centers and local 
information/intelligence gathering, particularly as it relates to any terrorism nexus. 

e. Survey 

Surveys are the second component of the methodology and will be 
conducted in conjunction with the interview and observation portion of my research. I 
have surveyed the STTAC and all four RTTACs. Commanders of the respective centers 
completed the surveys. Questions raised and answered in the survey are: 

1) Who are your consumers? 

2) What is the primary function of each fusion center? Should they be 
all crimes or purely counterterrorist? 

23 



3) Is their mission tactical or strategic? 

4) By what methods do they receive taskings and from whom? 

5) How do they disseminate infonnation and to what purpose? 

6) How do the fusion centers collect infonnation from their 
emergency responder community and are those processes 
satisfactory? 

In some cases, respondents did not answer one or more of the survey 
questions. This seemed to occur with greater frequency later in the survey, it is unknown 
if this was survey fatigue or if it had to do with the individual question. No particular 
fusion center had a pattern of skipping questions. Eight questions had one skip, one 
question had two skips and one question had three skips. A total of twenty-eight 
questions were asked. The survey was conducted via SurveyMonkey with the four 
RTTACs and the STTAC (herein after referred to as survey). 

The respondents were advised that their individual responses would be 
kept confidential unless they specifically indicated the responses could be attributed. 
This was done to encourage as complete a disclosure as possible. A copy of the survey is 
attached in Attachment A. 

f Interviews 

The interviews included the director of the California State Office of 
Homeland Security, five RTTAC commanders (two from LA), TLO coordinators from 
the RTTACs, and a variety of law enforcement administrators. The objective was to 
determine their expectations of the fusion centers and tasking, as well as their 
understanding of the current system and their expectations. Interviews were also 
conducted with educators in the field and practicing analysts. The interviews were 
qualitative and unstructured, following basic thematic lines; each respondent represented 
a different area of expertise. 
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II. SURVEY RESULTS 


Fusion center managers work in a classified environment where few others have 
access. They know what infonnation is available from the federal classified databases, 
open sources, classified human intelligence, and local information sources. The fusion 
center managers also know what cases are being investigated, and what type and quality 
of information is needed to fill their threat assessment gaps — as well as assist their 
investigative capacity. For this reason, the respective RTTAC commanders, or co¬ 
managers, were chosen as the survey respondents. In the case of the STTAC, the 
respondent was a designee. All respondents identified their organizations as fusion 
centers. 

The survey revealed that most fusion center respondents believe that law 
enforcement and investigators are their primary customers, but that they will provide 
strategic assessment to policy makers as need. The majority also has an all-crimes 
perspective and felt that to do otherwise would minimize their value to their customer 
base. They also felt that the emergency responder community had valuable information 
to share and that, in fact, the largest source of local data that they relied on came from 
law enforcement and TLOs. The fusion centers also reported that they had developed 
appropriate reporting mechanisms, but that the emergency responders were not reporting 
up to expectations. Community-oriented policing contributed very little to the 
counterterrorism effort. 

All of the fusion centers had a TLO program with both fire and law enforcement. 
Law TLOs provided more tips and information collection, while fire TLOs provided 
more administrative support and line-level education. 

A. SURVEY RESPONSES 

1. Who are Your Consumers? 

In response to the question, “who are the primary consumers of your product,” the 

survey overwhelmingly identified investigators and law-enforcement as their primary 

customer. Fifty percent of those responding to this survey question identified law- 
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enforcement and investigators as “always” the primary consumer of their product. 
Whereas 75 percent of the respondents indicated that policymakers were “often” 
consumers of their product. Non-law-enforcement emergency responders had a range of 
responses, from 25 percent saying that they were “seldom” consumers of their product, to 
50 percent identifying the non-law enforcement responder community as “often” a 
consumer, and 25 percent identifying them as consumers “most of the time” (one 
respondent skipped this question). Two-thirds of the respondents identified elected 
officials as “seldom” a consumer of their product (two respondents skipped this portion 
of the question). 


Primary Consumer of Fusion Center Product 
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Figure 1. Fusion product consumers.(From STTAC/RTTAC Survey) 

2. What is the primary function of each fusion center? Should they be 
all crimes or purely counterterrorist? 

The survey indicates that the majority of the centers, 60 percent, engage in an all 

crimes perspective for fusion center operations. One of the exclusively counter terrorist 

perspectives was Los Angeles (noted with permission), which investigates and analyzes 

counterterrorist activity but also considers criminal activity with a terrorist nexus such as 
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financial crimes (they maintain connectivity via the TLO program with officers in the 
various investigative units). For the fusion centers that have an all crimes perspective, 75 
percent of the respondents identified financial crimes and gangs as crimes that they 
conduct analysis on. Narcotics, crimes of violence, and counterfeiting (other than 
money) were all identified 50 percent of the time as crimes that the fusion centers 
worked. One respondent skipped this question. 


Unit Focus on Crimes other than Terrorist Threats 



Figure 2. Criminal focus of all crimes fusion centers. From STTAC/RTTAC survey 


For the all crime fusion centers, only 50 percent had a policy that guided the 
decision on what crime or case would be analyzed. The remaining centers relied on the 
supervisor, director or analysts to make the decision. The response to the question 
(which provided for a narrative response) of whether there was sufficient purely 
counterterrorist activity to consistently support a fully staffed fusion center was mixed. 
Two responded yes, one responded no, the fourth replied that fusion centers should be all 
crimes, and one skipped the question. 
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The survey data also suggests that useable intelligence product would be lost if 
their center were to focus exclusively on counterterrorist activity. Fifty percent of the 
reporting fusion centers stated that “usually” or “almost always” would there be a loss of 
intelligence data. Fifty percent also felt that value to consumers would “usually” or 
“almost always” be reduced and 25 percent felt that “sometimes” the value to consumer 
would be reduced. 

3. Is their mission tactical or strategic? 

The data from the survey indicates that 60 percent of the fusion centers had both a 
strategic and a tactical capability with two respondents skipping the question. This 
finding was supported by the interviews from the commanders of the four RTTACs. The 
Bay Area RTTAC and the Sacramento RTTAC primarily do investigative tactical case 
support, but they do some strategic analysis on request or when they deem such a need 
exists. The LA RTTAC does some investigative case support but primarily provides 
strategic analysis. While the San Diego RTTAC does purely strategic support. 

4. By what methods do they receive taskings and from whom? 

This question was posed requiring a narrative response of which four of the five 
centers responded. None of the respondents cited a policy guiding tasking requirements, 
but all of them were receptive to external taskings. One response indicated any ranking 
member of the department could initiate a tasking, another stated any of the main 
stakeholders could do so. The two remaining centers stated that either local or federal 
agencies could initiate a request. 

The survey data also found that 100 percent of the fusion centers felt they could 
“task” the emergency responder community with requests for information in the form of 
information bulletins advising the ER community to be alert for whatever specific 
information was needed. 
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5. How do they disseminate information and to what purpose? 

Two of the five fusion centers disseminate between 25 and 50 percent of their 
product at the Law Enforcement Sensitive (LES) level and a third fusion center 
disseminated 50 to 75 percent of its product at the LES level. The remaining two fusion 
centers disseminated between 10 and 25 percent of their product at the LES level. All 
five of the fusion centers disseminated less than 10 percent of their product at the secret 
or top secret level. The survey also revealed that three of the five fusion centers 
disseminate between 25 and 50 percent of their product at the FOUO level and the 
remaining two fusion centers disseminate between 50 and 75 percent of their product at 
the FOUO level. 

The survey indicated that FOUO information was disseminated 40 percent of the 
time by e-mail and 60 percent of the time by a secure electronic communication. LES 
information was disseminated in the same manner. Secret and top secret intelligence was 
disseminated 80 percent of the time in person and 20 percent the time by “other.” Sixty 
percent of the fusion centers had an internal method to disseminate intelligence to field or 
line level emergency responders and 60 percent relied on liaisons between the fusion 
center and the line personnel to disseminate intelligence. One center had both methods of 
dissemination. 

6 How do the fusion centers collect information from their emergency 
responder community and are those processes satisfactory? Also, what are 
their collection methods and the scope of their collection process? 

The results from the survey show that four out of five of the fusion centers receive 
between 25 and 50 percent of their source data from local agencies, which was the single 
largest source for data that analysts use at the state and local fusion centers. The survey 
also showed that two of the five fusion centers received less than 10 percent of their 
source data from the federal government and four out of five fusion centers said that they 
received less than 10 percent of their source data from the state government. This survey 
clearly indicates not only the value, but the usefulness of local data as a source of 
analysis for state and local fusion centers. 
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Of the local data sources two of the five fusion centers identified law enforcement 
as providing between 50 and 75 percent of the their data with a third reporting law 
enforcement as the source of between 75 and 100 percent of the source data. Terrorism 
Liaison Officers (TLO) were the source of 50 to 75 percent of local data for two fusion 
centers and between 75 and 100 percent for two more. Sixty percent of the fusion centers 
reported receiving less than 10 percent of their local data from fire personnel, and two 
fusion centers reported receiving between 10 and 25 percent of their data from the fire 
service. All five fusion centers reported receiving less than 10 percent (this was the 
lowest rating on the scale) of their local source data from each of the categories of: pubic 
health, emergency medical services, and public works. 

The survey also reported that 80 percent of the fusion centers felt that the 
emergency responder community is not being appropriately utilized as a data source. 
There was a wide range of variability in response to the question: Do you think that, as a 
source, the line level emergency responder community has access to potentially valuable 
information. The response was: one fusion center reported “sometimes,” a second 
reported, “often” a third reported “usually,” a fourth reported “almost always” and the 
fifth reported “always.” This range may represent a philosophical approach to the unused 
potential of the ER community or it may reflect how much each of the fusion centers uses 
the ER community in their sphere of influence. There are many other potential 
explanations for the variance but the data is insufficient to be able to try to interpret the 
variance in response. Nonetheless, 80 percent of the fusion centers felt that the 
emergency responder community had access to potentially valuable information between 
“often” and “always.” This is clearly a sufficient intelligence potential in the emergency 
responder community for the fusion centers to attempt to acquire this infonnation. 

The surveys point to a perceived lack of situational awareness by the ER 
community as a problem. Although the managers of the fusion centers felt that, by and 
large, the emergency responder community had access to potentially valuable 
information only one of the fusion centers reported that the ER community “usually” 
knew what to look for. Two of the fusion centers felt that the ER community “often” 
knew what to look for and another two others felt that the ER community only 
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“sometimes” knew what to look for. Three of the five fusion centers felt that they 
“usually” had appropriate reporting mechanisms for the emergency responder community 
to report suspected terrorist activity. The remaining two fusion centers reported that they 
thought the emergency responder community “sometimes” and “often” had appropriate 
reporting mechanisms. Sixty percent of the fusion centers thought the reporting 
mechanisms were either “almost always” or “always” available and user friendly and yet 
60 percent of the fusion centers felt that the emergency responder community was only 
“sometimes “ taking advantage of reporting opportunities. This data seems to suggest 
that, according to the respondents, the emergency responder community generally has 
access to useful information, has appropriate reporting mechanisms that are available and 
user friendly; and, yet are not reporting information as might be expected. 

A frequently cited source of potential data is community oriented policing (COP). 
The survey results state quite convincingly that this is currently not the case. Three of the 
five fusion centers reported that they get less than 5 percent of their tips or leads from 
COP. The fourth fusion center reported receiving 5 to 10 percent of their tips or leads 
from COP. Three of four respondents reported COP as an under utilized resource with 
one center skipping the question. 

One hundred percent of the fusion centers felt it was important to acknowledge 
the emergency responders that provide tips or leads. Two of the centers did so by phone 
with two more doing so by e mail. One center made the acknowledgement in person. 
None of the centers had an automatic acknowledgement system and all made the effort on 
an individual basis to respond to the tip. 

Results from the survey showed that all of the fusion centers have a TLO liaison 
with law enforcement and fire; and, 80 percent had a liaison with emergency medical 
services as well as public health. Only 20 percent of the fusion centers had a liaison with 
public works. The role the TLO varies according to which discipline and emergency 
responder community that the TLO is interacting with. In the law-enforcement discipline 
all five fusion centers reported the role of the TLO was to collect information and to 
facilitate the program. Three out of five fusion centers reported educating line personnel 
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was an additional role for law enforcement TLOs. Two of the five fusion centers 
reported educating administrators and investigating tips was also a role for law 
enforcement TLOs. 

Law enforcement and fire reported to have the biggest roles in the TLO program. 
The biggest difference being that fire TLOs provided more administrative support and 
law enforcement TLOs were reported to have more of a role in collecting information and 
providing tips. 



Figure 3. Role of the TLOs. (From STTAC/RTTAC survey) 


B. SACRAMENTO JOINT POWERS AUTHORITY (JPA) SURVEY 

Comparisons between fusion centers are difficult because there are no 
standardized definitions for the types of analysts and what their product is or should be. 
Sacramento received a grant from the DHS to provide fusion analyst training on a 
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nationwide scale. As part of developing curriculum, the Sacramento Joint Powers 
Authority, responsible for the program, conducted an infonnal phone survey of fusion 
centers across the country. Thirty six fusion centers were identified as operational; of the 
thirty six, twenty-one agreed to participate in the interview. The interviews were 
conducted by phone and the respondents’ answers were recorded by staff. 

One of the questions on the phone survey was: How are your fusion center 
analysts different from crime analysts? Of the twenty-one responses, five stated there 
was little or no difference, twelve described their analysts function as tactical, because 
they also conducted counter terrorism support. Only four gave responses that may 
indicate that strategic analysis was being conducted. Another question was: What 
percentage of your analysts’ time is spent on terrorist threat analysis? Eleven fusion 
centers responded low or very low with given percentages ranging from 10 to 30 percent. 
Some respondents did not give an approximate percentage and identified the level of 
threat assessment activity as minimal or very low. Five fusion centers gave a mid-range 
level of time spent on threat assessments, rating themselves as being between 50 and 70 
percent. Four fusion centers rated their percentage of terrorist threat assessment as high 
or very high, between 80 and 100 percent. 48 

In the informal survey conducted by the Sacramento Joint Powers Authority, the 
twenty-one fusion centers that responded to the survey identified analytical skills and 
writing skills as the area where their analysts needed the most improvement. Eighteen of 
the twenty-one centers stated that their analysts had received some training in analytical 
thinking and analytical tools. Training identified as most needed included analytical 
skills, terrorism fundamentals, and report and analytical writing. Other identified training 
needs were: identifying reportable intelligence, intelligence methodologies, open source 
exploitation, anticipating law enforcement needs, advanced research skills, and analytic 
tools. 49 


48 Sacramento Joint Powers Authority, Fusion Center Intelligence Analyst Job Task Analysis and 
Training Needs Assessment, July 27-August 1, 2007. 

49 Sacramento Joint Powers Authority. 
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c. 


SUMMARY OF THE CALIFORNIA FUSION CENTERS SURVEY 


• Law enforcement and investigators are the primary customers of fusion 
centers as identified by fusion center commanders 

• Policy makers are secondary customers of fusion centers 

• A modest majority of the fusion centers have an all crime perspective 

• Of the fusion centers that do have an all crime orientation the crimes most 
often targeted are financial crime and gang activity 

• Half of the reporting fusion centers stated their value to consumers would 
be diminished if they did not include an all crime perspective 

• Most of the fusion centers (60 percent) have a strategic and a tactical 
capability 

• The fusion centers are receptive to taking tasking requests from almost 
anyone in authority 

• A significant amount of intelligence product is disseminated at the LES 
level 

• The majority of intelligence product is disseminated at the FOUO level 

• Local agencies were the single largest source of data for the fusion centers 

• Law enforcement and TLOs provided the majority of local source data 

• The vast majority of the fusion centers felt that the emergency responder 
community was not being appropriately utilized as a data source 

• Situational awareness seems to be lacking in the emergency responder 
community 

• Community-oriented policing is largely ineffective in providing 
information to the fusion centers 

• The vast majority of fusion centers felt COP was under-utilized as a 
potential data source 
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• All of the fusion centers have a TLO liaison with both law and fire 

• Law TLOs provided more tips and information collection than did fire 
TLOs 

• Fire TLOs provide more administrative support and line level education to 
their agency than law TLOs 

D. SUMMARY OF THE SACRAMENTO JOINT POWERS AUTHORITY 

(JPA) SURVEY 

• Of the twenty one responses on the national survey, only four gave 
responses that gave an indication of conducting strategic analysis in their 
fusion centers 

• Half of the fusion centers spent little or very little of their time on terrorist 
threat analysis 

• Almost 90 percent of the fusion center analysts had received some 
training in analytic thinking and analytic tools 

• Training that the fusion centers identified as most needed was analytical 
skills, terrorism fundamentals, report and analytical writing 
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III. ANALYSIS OF CURRENT PRACTICE FOR FUSION 

CENTERS 


Prevention is the first of the four goals of the National Strategy for Homeland 
Security. 50 It can be argued that fusion centers provide an excellent opportunity to 
provide that prevention. This thesis will not attempt to justify or validate the 
effectiveness or usefulness of fusion centers. The performance measures and metrics for 
such an assessment are lacking and will be left to future studies. While this thesis will 
not measure the effectiveness of the fusion centers, it remains critically important that 
fusion centers are, or become, effective. This thesis accepts the fact that significant 
resources, both in money and personnel, have been dedicated to fusion centers. This 
thesis will focus on what practices may provide the greatest value for the jurisdictions 
that support them and thereby improve their potential usefulness for future assessments. 

Fusion centers evolved because of a perceived need at the local level. This need 
must be met if fusion centers are to become, or remain, viable. In testimony before 
Congress, Norman Beasley, Counterterrorism Coordinator for Arizona, spoke in 
reference to fusion centers: 

Their ultimate goal is to support their consumers with beneficial 
information. But, the consumers also have a critical role in the production 
of information and ultimately intelligence. 51 

The “consumers” Norm Beasley is referring to are the local policymakers and 
emergency responder community. 

A. MANAGEMENT OF THE FUSION CENTER 

For the fusion centers to run efficiently and effectively, they will need to have a 
clear mission, internal organization, a strategic purpose, and adequate resources to fulfill 
their duties. If fusion centers are to be effective and relevant at the local level, they need 

50 National Strategy’ for Homeland Security, Homeland Security Council, October 2007, 1. 

51 Beasley, Testimony before the U.S. House of Representatives. 
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to meet the needs of the local ER community. To do this, they must produce timely, 
relevant, locally actionable intelligence that can be used either by local policymakers for 
situational awareness, resource deployment or protection efforts, or for investigation or 
preemption at a local level. 

1. Mission 

To meet the most basic of concepts for a fusion center, developing a mission 
statement, the center must identify who their customers are and what products they want. 
As stated in the Fusion Center Guidelines, guideline number two, fusion centers should 
develop a mission statement via a collaborative process. 52 The guidelines also state that 
the governance board should define a management structure to include what entity will 
oversee the center’s operations and daily activities. There is no recommendation on how 
that should be accomplished; instead, it is left up to the individual fusion centers to 
develop a system that works best for them. 

The nature, role, staffing and mission of state and local fusion centers varies 
widely throughout the nation and even from center to center in California. Jerry 
Murphy, director of homeland security issues for the Police Executive Research Forum 
(PERF), is undertaking a national study of fusion centers for DHS. He notes that the goal 
of DHS is not to create cookie-cutter molds for fusion centers, but to respond to the local 
needs. Trying to figure out what is the best model — and what are the appropriate 
divisions of labor for local agencies in the investigation of the crime of terrorism — is a 
complex issue. Murphy makes the observation that the FBI clearly has the lead in any 
terrorist investigation; establishing the role of state and local government in the 
counterterrorism world will determine, to a large extent, what happens in a local fusion 
center. He believes the future of fusion centers may be a movement away from the true 
intelligence community interpretation for a fusion center to one that is more relevant 
locally. What is the payback for local law enforcement for their commitment of time and 


52 Fusion Center Guidelines, 23. 
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resources? 53 The mission of any fusion center needs to identify its role and its customer, 
and to produce a product of value to be sustainable. 

Norm Beasley describes the process of refining one’s mission into written form as 
a critical step, delineating the roles and responsibilities of everyone associated with the 
fusion center. A written mission statement or a concept of operations lets your customers 
know who you are and what you do, as well as those who may be concerned about the 
abuse of civil rights. A written code of conduct and method of operations will provide 
guidance and protections. Having a documented operating procedure will help protect 
the organization from challenges of excess. 54 

The STTAC and the four RTTACs collaborated on a concept of operations plan 
as a guiding principle for all five of the threat assessment centers that also function as 
fusion centers. As part of that concept of operations, a mission statement and a vision 
statement is included. The mission statement is: 

The mission of the state terrorism threat assessment system is to foster a 
collaborative effort to collect and analyze criminal infonnation, employ 
cutting-edge analytical tools and methodologies to produce and share 
timely and actionable Homeland Security intelligence, thereby enhancing 
the safety of the citizens of California. 55 

For any fusion center to function in a coherent, let alone efficient, manner, it must 
have a mission that is a collaborative derivative of the governance board and the senior 
members of the fusion center. That mission will have to be more than a platitude on page 
two of some document that no one reads. The mission will have to be conveyed and 


53 Jerry Murphy, Police Executive Research Fomm, Director of Homeland Security, Interview, 
December 17, 2007. 1. 

54 Beasley, Maricopa County Sheriff s Department, Counter Terrorist Coordinator, Former Arizona 
Department of Public Safety, Director of Arizona Counter Terrorism Information Center, (Ret.), the 
development of mission statements and concept of operations plans is one of the tasks that Mr. Beasley 
performs in his role as technical advisor for DHS, December 3, 2007. 

55 Strategic Business Plan Concept of Operations, California State Terrorism Threat Assessment 
System, nd, 3. 
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reinforced in deed and action. The question becomes whose mission statement gets 
adopted and to what purpose. To answer that question, one must identify “who” is the 
customer or customers of the fusion center. 

a. Customer Identification 

In the survey conducted with the four RTTACs and the STTAC, the fusion 
centers overwhelmingly identified investigators and law-enforcement as their primary 
customer. However, the question remains: Does this fit in with their mission statement? 
Congruence between mission statement, customer identification, and product output is 
critical to the usefulness and cohesion of a fusion center, and will promote sustainability. 
If the majority of the fusion center's customer base is law enforcement, what products are 
being produced for them to consume? If one considers law enforcement a primary 
customer, are there sub-customer groups within that category? One could logically argue 
that law enforcement administrators are customers, as well as rank-and-file law 
enforcement officers, and investigators could be a third set of customers within the law 
enforcement domain. Fusion centers have many other customers to consider besides law 
enforcement, such as policy makers, fire, EMS, etc. 

A lack of organizational customer identification will often translate 
throughout the fusion center with the result that product delivery may be accurate but it 
may also be erratic and inconsistent. During a recent training seminar in Monterey, 
sponsored by the STTAC for the RTTAC and STTAC analysts, there was a definite lack 
of clarity amongst the analysts as to who their customers were. There was very little 
consensus of who was the customer and what the customer wanted in the way of a 
product. The analysts had received very little feedback that could guide their 
requirements. This lack of clarity, by the analysts who write the product, can only have a 
negative impact on the usefulness and assimilation of their written product. 56 

This lack of customer identification, by a large segment of the analyst 
pool, supports the absolute need to identify, specifically, who the customer is for what 

56 Analyst Training Seminar, Monterey, California, Sponsored by the California State Terrorism 
Threat Assessment Center, January 23, 2008, personal observation. 
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intelligence product. It may well be that there can be multiple customers. For example, 
executives and elected officials may be customers for strategic threat assessments and 
situational awareness; JTTF task force members could be customers for terrorism 
investigative case support; and criminal investigators or law enforcement officers could 
be customers for major criminal case support. 

In addition to identifying all of your customers, one must consider at what 
level they will consume. What level of detail or how much information is required for 
each customer? Do you have consumers that want to consume your product, do they 
consume it, or are they more interested in crime trends rather than emerging threats in the 
Middle East that may or may not arrive in their back yard?. In addition to identifying 
your customers, fusion centers need to identify what consumers want in a product, and 
balance that with other obligations of the fusion center. 57 

Local fusion centers need to assume the responsibility to reach out to local 
administrators to find out precisely what information or intelligence products are desired. 
Norm Beasley makes the point that it is paramount to a fusion centers’ success to 
discover that need and provide it. He also makes the point that the local administrators 
and consumers have an absolute responsibility to tell the fusion centers what they want 
and, just as importantly, what they do not want. 58 Will a local chief of police read a 
twenty-five-page brief on gangs? 

The interviews generally seem to bear out the finding of the survey, which 
identified law enforcement and investigators as the primary customer of the fusion 
centers. In an interview with Roseville Fire Chief Ken Wagner, he stated that he felt that 
the fusion centers were primarily a law enforcement tool, but that they did have a definite 
capability for the fire department. He added that he relied on the fusion center to provide 
him with the information that he needed as an administrator for situational awareness. 
He also relied on his battalion chief, assigned to the Sacramento Regional Office of 


57 Phil Bodenhorn, Supervisor, Sacramento FBI Field Investigative Group, December 5, 1007. 

58 Beasley, interview. 
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Homeland Security, to relay information that was relevant to the firefighters for either 
their safety or as a tasking requirement in the form of a request for information. 59 

Law enforcement administrators did feel that LE should be the primary 
focus, but noted that they would like to see more emphasis on major crimes and better 
situational awareness for administrators. Sacramento Chief of Police Rick Braziel 
observed that fusion centers are most effective when they engage the law enforcement 
community more in a preventive posture — and not just for counterterrorism, but for 
major crimes. As an example of a requirement, he would propose addressing regional 
crime issues, such as gangs, regionally, rather than pushing it back and forth across a 
jurisdictional boundary. 60 This sentiment was echoed by Sacramento County Sheriff 
McGinness who took the position that the fusion center mission could include anything 
that would make the community, or officers working in the community, safer. 61 

Care must be taken to ensure that there is congruency between who the 
fusion center believes its customer to be and who the governing board believes the 
customer should be. An involved and active governance board should be aware of the 
standing requirements and the identification of the primary and secondary customers of 
the fusion center, and ensure that those needs are being met. In the event of a conflict, 
skillful leadership with a collaborative and network-oriented approach will be required to 
reach a compromise amongst the varying jurisdictions and disciplines. The regional 
partners in the governance board must be able to set the requirements, or the objectives, 
of the fusion center. 

b. Tasking 

A clear and definitive set of standing tasking requirements, along with 
clear identification of who the customer is for those particular tasking requirements, will 
add to the quality and ultimate usefulness of the end product. This was an issue 
discussed in the recent analyst training in Monterey, and was an issue that was 

59 Ken Wagner, Roseville California Fire Chief, interview, November 21, 2007. 

60 Rick Braziel, Sacramento Chief of Police, interview, December 4, 2007. 

61 John McGinness, Sacramento County Sheriff, interview, December 19, 2007. 
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widespread throughout the ranks of the analysts represented at the training. 62 One of the 
biggest problems facing fusion centers is getting law enforcement administrators to 
establish standing requirements. Law enforcement administrators cannot become 
efficient consumers of intelligence if they do not take an active part in establishing what 
requirements are established or why. The standing requirements of a fusion center should 
not be established in an ad hoc fashion. 63 For the fusion centers to have value to the ER 
community the ER administrators should have input as to the priorities of what product is 
produced. ER administrators will have to be educated on the intelligence process and 
how to become effective consumers of intelligence. 

The LA RTTAC does not have a written standing tasking requirement, 
partly due to the co-management of the organization between LASO, LAPD and the FBI. 
Tasking is done by the manger on duty as the need of the situation presents itself. 64 The 
tasking assignments to analysts in the Northern California RTTAC and the Sacramento 
RTTAC are done by the supervisors. 

Just as the regional partners can task the fusion center by establishing the 
appropriate standing requirements for the fusion center, the fusion center must be able to 
task the ER community for new, additional, or supplemental infonnation. A robust 
mechanism for this tasking must be established. The survey data found this to be the 
case. 

All of the fusion centers were flexible in who could task the center with a 
request for an intelligence product; anyone with an administrative association would be 
able to make such a request. This collaborative approach is salutary. An unanswered 
question is who takes advantage of this capability, and how often. 

An additional point on tasking is made by Norm Beasley. He suggests 
that, in addition to having local administrators assist in establishing standing 

62 Analyst Training Seminar, Monterey, California. 

63 Personal communication with a confidential source who is a career intelligence analyst, February 
22, 2008. 

64 Robert Galarneau, Lieutenant, Los Angeles County Sheriff s Department, Co-Manager of the LA 
Regional Terrorism Threat Assessment Center, interview, December 14, 2007. 
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requirements for state and local fusion centers, a national network of fusion centers 
should be established with federal guidelines on standing requirements from the federal 
government to the state and local fusion centers. This is not a task the government will 
be anxious to do as it may give the appearance of trying to take over the local fusion 
centers. But a network is just that, an exchange of information with two-way tasking at 
all levels. Local centers could task the federal government for intelligence gaps on local 
threat activity and the federal agencies could task the locals with their greater number of 
assets and community contacts. This will be a rather delicate undertaking but nonetheless 
a worthwhile one. 65 

Finally, once the mission and customer identification has occurred, the 
center will need to determine at what level each customer will be supported. Is the 
primary mission of the center to support counterterrorist efforts, criminal case support, or 
situational awareness? Most will have all three and an equitable (based on identified 
need) distribution of resources and product will go a long way to crystallizing the 
mission, meeting expectations and gaining customer satisfaction. 

To accomplish this, the fusion centers will be required to develop a 
method of prioritization for resource allocation, which should be based on the local threat 
picture. This concept is supported by the Fusion Center Guidelines, guideline number 
two, 66 which calls for a prioritization of intelligence functions to address local threats. 
This point is central to one of the major themes of this thesis, which is intelligence 
products that are produced by the local fusion centers must not only be timely, but must 
be locally actionable if they are to provide the preventive value that should be expected 
of fusion centers. 

2. Philosophy 

How fusion center professionals approach their job and how the decisions are 
made about the operational functions of the fusion center are perhaps just as important as 
what those operational functions become. If partners are made to feel excluded or 

65 Beasley, interview. 

66 Fusion Center Guidelines, 23. 


44 



denigrated, cooperation and collaboration will be relegated to catch phrases, and the 
potential benefits of true collaboration and networking will be lost. It is important that 
leaders in fusion centers have an understanding and embrace a collaborative and inclusive 
environment when making decisions on standing requirements and the operational 
posture of the fusion center. To do that, fusion center leaders need to come to an 
agreement on what the basic operating principles of the center are and how they will be 
addressed. Among issues that should be considered are the value of prevention, risk 
management, what is the local threat, strategic vs. tactical support, all crimes vs. strictly 
counterterrorist perspective, prioritization, and standing tasking requirements. 

a. Prevention 

The threat of a terrorist attack has dramatically shifted the focus of local 
law enforcement. Much has been written about the need for local law enforcement to 
take an active role in not only preparing to respond to an attack, but more importantly, 
being a major player in preventing an attack. This is a new role for domestic law 
enforcement and the major sticking point is how best to accomplish this obvious but 
elusive goal. 

Almost every jurisdiction that chooses to address the issue (and not all 
do), has a different approach with varying degrees of success. One comes up against the 
requiem: How do you measure what has not happened? The Director of the California 
State Office of Homeland Security, Matt Bettenhausen, illustrates this problem stating, 
“The more successful you are, the less you have to show for it.” He adds that 
“prevention is our first goal, and prosecution comes next. If prosecution were our first 
priority, it would be better to allow some of these groups to develop more, but the stakes 
are too high.” 67 

The range of operational responses varies dramatically from state to state 
and from jurisdiction to jurisdiction. Some jurisdictions (or administrators) feel that “it 
won't happen to us” and put very little effort into prevention. Instead, they focus much of 


67 Bettenhausen, interview. 
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their homeland security resources into a response capability, which they may be able to 
use in events other than a domestic terror attack. However, a significant number of 
jurisdictions are beginning to recognize the value of prevention over that of response, 
realizing that if we need to respond to a domestic terrorist attack we have, to a certain 
extent, already lost. 

If fusion centers are to be seen as valuable enterprises, worthy of their 
funding and resource expenditure, the governance board and the management of the 
fusion centers must adopt a philosophical acceptance that prevention is key to homeland 
security, and be able to convey that message to the local political and administrative 
leadership. The shift of identifying homeland security protection from response 
equipment procurement to intelligence-inspired prevention is one that will require 
support and evidence. Homeland security dollars are moving away from response and 
into prevention. There are constituent groups that will be resistant to this shift. For some 
years, response capacity has been the major benefactor of grant dollars with the purchase 
of costly response equipment. Many local administrators will be loathe to give up their 
big-ticket equipment items, previously paid for by grants in exchange for information or 
intelligence that may or may not prevent an attack that may or may not happen. 

Fusion center advocates will need to demonstrate that intelligence, tailored 
to the sphere of influence of each individual fusion center, is an approach that can 
provide protection for the homeland if fusion centers are to gain acceptance from the 
local emergency responder community, and more importantly, their administrators. To 
this end, fusion centers may well need to include threats other than terrorists. 

The CRS report reinforces the point that fusion centers can enhance 
protection with the observation: “Creating a fusion center is a tangible action that seeks to 
enhance state and/or regional coordination and cooperation to prevent and mitigate, and 
in some cases, respond and recover from homeland security threats.” The report 
continues the argument for a common adoption of the prevention philosophy stating, 

If fusion center constituent agencies don’t buy into a common fusion and 
prevention philosophy that arguably needs to accompany fusion centers 


46 



(i.e., responsibility for security, a proactive approach, and need for 
understanding their environment to discern potential threats), can fusion 
centers be effective? 68 

An educational marketing campaign on the value of prevention and the 
potential of the fusion center to promote that prevention should be a combined message, 
presented by an influential coalition. 

A final point that will undoubtedly generate controversy: What is the risk 
management strategy that will be supported by the fusion center? Should the standing 
requirements of the fusion center give priority to the less likely but potentially 
devastating WMD attack, or should the more likely, less catastrophic conventional attack 
with perhaps a VBIED, be the priority of the fusion center? These issues will not be 
answered in this thesis. For the efficient operation of fusion centers, however, they will 
need to be addressed by the governance board, emergency responder senior executives 
and elected officials. Brian Jenkins weighs in on this point in his testimony before 
Congress, stating, 

allocation of resources must be based upon assessments of risk — we are 
moving in this direction. The choice lies between focusing on the most 
likely events in the lower registers of violence or on the less likely events 
that would have the greatest consequences. 69 


b. Establish a Local Threat 

In order to form a cohesive prevention posture, adopted by administrators 
and line personnel, the fusion centers will have to identify what it is that they are trying to 
prevent; identifying a local threat will aid in this effort. The National Intelligence 
Estimate: The Terrorist Threat to the U.S. Homeland, released in July 2007, states: 

We assess that the spread of radical — especially Salafi — Internet sites, 
increasingly aggressive anti-U.S. rhetoric and actions, and the growing 


68 Masse et al., CRS Report for Congress, 10. 

69 Jenkins, testimony before the committee on appropriations subcommittee on Homeland security 
United States House of Representatives, January 30, 2007; this paragraph is a paraphrase or string of quotes 
of Jenkins's testimony, 2-4. 
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number of radical, self-generating cells in Western countries indicate that 
the radical and violent segment of the West's Muslim population is 
expanding, including in the United States. 70 

The estimate goes on to say that: 

We assess that globalization trends and recent technological advances will 
continue to enable even small numbers of alienated people to find and 
connect with one another, justify and intensify their anger, and mobilize 
resources to attack—all without requiring a centralized terrorist 
organization, training camp, or leader. 


The ability to detect broader and more diverse terrorist plotting in this 
environment will challenge current U.S. defensive efforts and the tools we 
use to detect and disrupt plots. It will also require greater understanding of 
how suspect activities at the local level relate to strategic threat 
information and how best to identify indicators of terrorist activity in the 
midst of legitimate interactions. 71 

The 2008 Annual Threat Assessment from the Director of National 
Intelligence reiterates the threat potential on our domestic front: 

While the threat from such homegrown extremists is greater in Europe, the 
U.S. is not immune. The threat here is likely to be fueled in part by 
propaganda and mischaracterizations of U.S. foreign policy as harmful to 
Muslims, rather than by any formal assistance from al-Qa’ida or other 
recognized groups. The al-Qa’ida-propagated narrative of an “us versus 
them” struggle serves both as a platfonn and a potential catalyst for 
radicalization of Muslims alienated from the mainstream U.S. 
population. 72 

Given the uncertainty of the environment — and the relative ease of 
operation with which disaffected and hostile individuals can anonymously engage with 
and reinforce one another — it is impossible to detennine, with any degree of certainty, 


70 National Intelligence Estimate, the Terrorist Threat to the U.S. Homeland, Office of the Director of 
national intelligence, http://dni.gov/press releases/20070717 release.pdf . Last accessed January 17, 2008. 

71 Ibid. 

72 Michael J. McConnell. Director of National Intelligence, Annual Threat Assessment of the 
Intelligence Community for the House Permanent Select Committee on Intelligence, February 5, 2008, 9. 
http://www.tsa.gov/assets/pdf/020520Q8 dni testimony.pdf . Last accessed, February 26, 2008. 
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the extent of our threat in any locale. To illustrate the point, consider the jihadist terrorist 
cell uncovered in June 2005 in the rural farming community of Lodi, California. The 
discovery resulted in one conviction for providing material support for terrorism, a 
twenty-four-year prison sentence and the deportation of two local Imams. Prior to the 
discovery of the cell, few people would have chosen Lodi as the location of an emerging 
jihadist terrorist cell. The potential for these cells and other domestic single-issue 
terrorist groups to spring forth without warning is a byproduct of our technological and 
interconnected world. 

Among the countervailing points of view is the notion that the domestic 
terrorist threat is not as dire or imminent as we have been led to believe. Proponents of 
this argument believe that the United States will be able to absorb any such attack in 
stride. A lack of successful jihadist terrorist attacks in the intervening years since 9/11 is 
frequently cited as evidence for the position. This is a compelling argument, although 
several attempts throughout the country have been disrupted before the terrorists could 
implement their attacks. Those arguing the position that the domestic threat is not 
significant will point out that these attempts were so ill-formed that they were never able 
to be initiated. 

Director Bettenhausen gives context to this argument during his interview. 
His position was that many of the domestic plots that have been uncovered nationwide 
were unsophisticated, and considered to have minimal potential by some. Who would 
have thought, however, that nineteen guys with box cutters could have done what they 
did prior to 9/11? Much of our success is due to interdicting potential threats at the 
lowest level of discovery. We do not allow the enterprise to grow; our best course of 
action may be deportation or exposure. 73 

The mere threat of becoming a victim of a terrorist attack can have a 
severe impact on a community, including the mental-health of its residents and the way 
they conduct their daily lives. As an example, consider the DC sniper attacks and how 
they affected that community. These were two unsophisticated and unsupported lone 

73 Bettenhausen, interview. 
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wolf criminals — not ideologically motivated terrorists, pursuing what they believed to 
be a just cause. A few such individuals could easily wreak that level of havoc on any 
community in our country. It is not unreasonable to believe that a small group of 
dedicated and motivated terrorists could, while not significantly disrupting the 
infrastructure of this country, have a significant impact on the national psychology and 
economy. 

It is a reasonable perception that a police officer or firelighter is unlikely 
to uncover a planned transnational terrorist plot or encounter and document a contact 
with one of its cell members. That position does little to counter the converse of the 
argument, that a local ER will have a far greater chance of encountering a terrorist plot or 
action emanating from within our borders. The threat posed by radicalized prisoners, 
single-issue terrorists — such as ELF or ALF, and more importantly local jihadists that 
have a sympathetic ideological link with A1 Qaeda and similar groups — will more likely 
be discovered or encountered by local ERs. 

While these attacks may lack the feared WMD capability, there should be 
no doubt that a group of serious and motivated individuals could produce an attack that is 
not only physically, but psychologically, catastrophic. You need go no further than the 
Oklahoma bombing to reinforce this point. Finally, many experts make the case that 
counterterrorism is more appropriately a police mission rather than relying primarily on 
the military. In a paper authored by Bruce Hoffman and Seth Jones (draft, cited with 
permission) they make the case that police have better training and more experience in 
responding to terrorist organizations and, historically, have greater success against them. 
The paper continues to say that the government should enhance police capacity to 
respond to the threat (specifically al Qaeda) much more robustly than has been done. 74 
An awareness of our local threat will assist us in focusing our prevention efforts and 
create a need for intelligence and data collection. 


74 Bruce Hoffman and Seth Jones, Countering a Resurgent al Qaeda (draft), cited with permission. 
May 22, 2007, https://www.chds.us/courses/mod/forum/discuss.php?d=8174 , last accessed, March 1, 
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c. 


Strategic vs. Tactical 


One additional perspective fusion centers have to consider is the type of 
analytical support that they provide. The question has arisen: Should fusion centers 
provide strategic analysis in the form of threat assessments or situational awareness for 
local executives and elected officials as the customer, or should they concern themselves 
with tactical case support for developing or ongoing investigations? 

The data from the survey indicates that 60 percent of the fusion centers 
had both a strategic and a tactical capability. This finding was supported by the 
interviews from the commanders of the four RTTACs. The Bay Area RTTAC and the 
Sacramento RTTAC primarily do investigative tactical case support, but they do some 
strategic analysis on request or when they deem such a need exists. The LA RTTAC 
does some investigative case support but primarily provides strategic analysis, while the 
San Diego RTTAC does purely strategic support. 

Comparisons between fusion centers are difficult, as there are no 
standardized definitions for the types of analysts and what their product is or should be. 
In the phone survey conducted by the Sacramento Joint Powers Authority one of the 
questions on the survey: How are your fusion center analysts different from crime 
analysts? Only four gave responses that may indicate that strategic analysis was being 
conducted. Another question: What percentage of your analysts’ time is spent on terrorist 
threat analysis? Eleven of the twenty three fusion centers responded low or very low. 75 

The Arizona Counter Terrorism Information Center (AcTIC) has separate 
analyst components that perfonn the distinctly different functions of tactical investigative 
case support analysis and strategic trend or threat awareness analysis. The tactical 
analyst unit has three analysts that perform analysis on active cases. Also in the AcTIC, 
the Arizona Department of Public Safety has a strategic analysis component (with two 
analysts and plans for two additional analysts) that focuses on national and world events 


75 Sacramento Joint Powers Authority. 
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and trends, and how they may affect Arizona. The AcTIC also houses the FBI’s Field 
Investigative Group (FIG) and their strategic analysis unit. 76 

This data would suggest that identification of customer and customer 
needs is extremely important to determine not only the end product but the value of that 
product to the customer. Needs identification will undoubtedly help focus mission and 
resource allocation within the fusion center as well as producing a usable product that 
will be of value to the identified customers. Note that the product need not be limited to 
strategic or tactical, and clearly can be both. To assist in prioritization of work product 
and resource allocation, however, it would be important to know what was the primary 
expectation. 

Many of the fusion centers’ employees who were interviewed for this 
thesis repeated the complaint that they were short-staffed and that without federal funding 
the fusion effort would be in jeopardy. It would seem prudent to make a concerted effort 
to seek out the emergency responder administrators and elected officials to give them 
regular threat assessments and situational awareness briefings to demonstrate the value 
and capability of the unit. They should also be made aware of, and encouraged to use, 
the tasking capability to have a strategic product prepared that is within the purview of 
the fusion center and is of concern to local officials. This level of customer service and 
interaction will not only help educate administrators as to the usefulness of the fusion 
center, but also establish contacts and the beginnings of a network. This increased 
interaction could lead to increased support and funding. 

d. All Crimes vs. Strictly Counterterrorist 

One of the most topical issues related to fusion centers is the question of 
whether fusion centers should focus exclusively on terrorism, as opposed to engaging in a 
broader scope of all crimes and terrorism. (All crimes rarely means “all crimes” but is 
usually meant to be certain organized crimes or major crimes such as narcotics, crimes of 
violence and gangs, or crimes that may be used to support terrorism efforts here or 

76 Lisa Ruggeri, Criminal Intelligence Analyst, Arizona Counter Terrorism Information Center, 
Interview December 20, 2007. Ms Ruggeri is currently assigned to the FBI JTTF. 
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abroad, such as financial crimes or fraud). The original intent of fusion centers, as they 
first began to emerge after 9/11, was to focus explicitly on the threat of terrorism. Since 
that time, the immediacy of the threat has faded and the trend has started to shift to an all¬ 
crimes approach. 

Jerry Murphy, Director for Homeland Security at the Police Executive 
Research Foundation (PERF), asserts that, in part, the shift is driven by relevance and 
workload; there is just not enough purely terrorist actionable intelligence to justify all of 
the fusion centers that are in operation. He also believes that a purely terrorist orientation 
would lead the centers to become irrelevant to local law enforcement, since the FBI has 
the primary counterterrorism role. 77 With the exception of New York City, he would 
anticipate all of the other fusion centers to begin a shift toward an all-crimes approach. 

Other supporters of a purely terrorist orientation for fusion centers come 
from those fusion centers located in mega-communities with a high iconic value such as 
New York City and Los Angeles. The survey of the four California RTTACs and the 
California State Terrorism Threat Assessment Center (STTAC) indicates that the 
majority of those centers, 60 percent, engage in an all-crimes perspective for fusion 
center operations. One of the exclusively counterterrorist perspectives was Los Angeles, 
(noted with permission), which investigates and analyzes counterterrorist activity but also 
considers criminal activity with a terrorist nexus such as financial crimes (they maintain 
connectivity via the TLO program with officers in the various investigative units). Due 
to their increased risk of attack and what is very likely a large volume of intelligence, it 
may be prudent for those mega communities to focus exclusively on counterterrorism. 
In something of a contradiction, which is an indication of the complexities associated 
with this question, 80 percent of the fusion centers identified themselves as “all crimes” 
in the interviews. 

A partial explanation may come from FBI Special Agent Oda, one of three 
co-managers of the LA RTTAC. He objects to the GAO report, citing only a small 
number of fusion centers are focused on counterterrorism. Oda notes that the Fusion 

77 Jerry Murphy, PERF, interview, December 17, 2007. 
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Center Guidelines recommend fusion centers consider an all-crimes perspective in order 
to more fully appreciate and gain information on the counterterrorism mission. While the 
LA RTTAC does not supplant other investigative units’ area of responsibility to 
investigate crime, they do consider a terrorist nexus to criminal activity. They rely on 
interagency cooperation to provide them needed information. Oda continues to say that 
LA RTTAC’s mission is counterterrorism, complemented by reviews of other criminal 
activity. Oda illustrates the point by stating that the vast majority of successful cases did 
not start out as a terrorist event but evolved from other criminal activity. 78 

The San Francisco Bay Area RTTAC operates an all-crimes fusion center, 
as does the Sacramento RTTAC. The San Diego RTTAC does not operate in an all¬ 
crimes mode; it is a member of a fusion center that consists of the RTTAC, a Law 
Enforcement Coordination Center (LECC), and the FBI’s Joint Terrorism Task Force. 
These three organizations fonn the fusion center. The LECC main function is the 
operation of four intelligence teams that focus on narcotics, gangs, border issues, and 
financial crimes. The LECC does not have a formal concept of operations or formalized 
information exchange mechanism with the RTTAC, but that is an identified problem that 
will be developed as the center matures. The San Diego model will be worthwhile to 
observe as it develops. 

A consideration for determining whether a fusion center should be all 
crime, or purely counterterrorist, should be predicated on the immediate threat picture in 
which the fusion center is operating. A majority of the state and local fusion centers have 
an all-crime perspective or mission in their fusion centers. Twenty-three of thirty-six 
operational fusion centers that provided mission statements to the GAO had missions that 
involved collecting, analyzing and disseminating criminal as well as terrorism-related 
information. 79 According to the GAO report, more than half of the fusion centers have 
an all-crime mission. 


78 Steve Oda, FBI Special Agent, Co-Manager LA RTTAC, interview, December 17, 2007. 

79 Eileen R. Larence, Director of Homeland security and justice issues, GAO testimony before the 
subcommittee on intelligence information sharing and terrorism risk assessment. Committee on Homeland 
Security, House of Representatives, space GAO -07-1241T, United States Government accountability 
office, September 27, 2007, 6-7. 
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Phil Bodenhorn, supervisor of the Sacramento FIG, takes the position that 
law enforcement has the mission to protect its citizens from harm. He believes that local 
fusion center intelligence requirements can be written for local crime requirements, as 
well as for national security counterterrorism. This will undoubtedly create a large list of 
requirements that must be distilled into a more precise list. He believes that local law 
enforcement could manage this with training, written guides, and the use of terrorism 
liaison officers as a resource for officers in the field. 80 

The counterargument to the purely terrorism position is varied and robust. 
Most jurisdictions do not have enough activity that can be readily identified as 
exclusively terrorist to sustain a fully staffed fusion center. 81 The survey data of 
California’s fusion centers supported this assertion; 50 percent of the fusion centers felt 
that there was not enough purely counterterrorist activity to consistently support a fully 
staffed fusion center. Only the most at-risk agencies would consider their jurisdiction to 
be sufficiently at risk of a terrorist attack that they would dedicate scarce resources to the 
sole effort of intelligence collection and analysis of a purely terrorist nature. Director 
Bettenhausen would agree that, in his opinion, there is not enough work in the fusion 
centers for strictly counterterrorism. He adds that everyday crimes can turn up 
information, especially crimes that can support terrorist operations. The public derives a 
benefit from the dual mission of conducting all crimes and counterterrorist analysis. 82 

Sheriff McGinness took the position that fusion centers should be all¬ 
crimes centers, noting that terrorist activity would be included in that category and clearly 
would be a priority. He added that numerous high-profile crime and terrorist incidents 
had been solved by happenstance unifonned officer contacts; these contacts in general 
could potentially yield a significant amount of information. 83 Chief Braziel weighed in 
on the issue unequivocally when he discussed the topic, saying that for local 
administrators to 

80 Bodenhorn, interview. 

81 Johnstone, personal communication, September 2007. 

82 Bettenhausen, interview. 

83 McGinness, interview. 


55 




continue to support fusion centers, particularly when funding for them starts to disappear, 
they will have to fight crime, specifically major crimes or crimes that can have a terrorist 
nexus. 84 

The survey data also suggests that useable intelligence product would be 
lost if their center were to focus exclusively on counterterrorist activity. Of the reporting 
fusion centers, half stated that there would “usually” or “almost always” be a loss of 
intelligence data. Half of the respondents also felt that value to consumers would 
“usually” or “almost always” be reduced, and 25 percent felt that “sometimes” the value 
to consumer would be reduced. 

Another potential hazard of following a purely terrorist approach is that if 
there were an insufficient level of meaningful work and analysts were not being 
challenged, not only would their skills erode but they might seek other opportunities. It 
is already very difficult for fusion centers to meet their staffing requirements; analysts 
often leave if they find the work unrewarding. 85 Chief Braziel made the observations 
that there was a need to keep analysts busy with real crime problems that are active in 
their area so their skills will remain sharp. He offered prison gangs a one potential area 
of investigation. 

Many terrorists allegedly sustain themselves by petty criminal activity, 
which may be uncovered by officers on a routine contact. It has been reported that many 
terrorist organizations support themselves through a variety of crimes including, but not 
limited to: identity theft, counterfeiting, financial crimes, fraud and narcotics. If a fusion 
center were purely counterterrorist-oriented, many connections to criminal activity with a 
potential terrorist nexus would likely go uncovered or unreported; seemingly innocuous 
bits of information may go unrecognized. 

A counterargument to the terrorist as a petty criminal is presented by the 
work of Marc Sageman. He makes the case that the evidence does not support the 
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frequent proclamation that terrorists (specifically what he terms global Salafi terrorists) 
engage in criminal activity to advance their cause. 86 

Most large and midsize state and local fusion centers are supported by 
local law enforcement who will expect some intelligence product that is locally 
actionable as part of a quid pro quo. In the survey, the fusion centers reported that they 
felt that support from parent agencies would “sometimes” be reduced if the fusion center 
did not have an all-crime perspective. If fusion centers are to be self-sustaining, they will 
need to demonstrate value to local officials and gain their goodwill and support. 
Producing a product that is timely, relevant and locally actionable will advance this 
cause. 

The crimes that these fusion centers tend to focus on outside of terrorism 
are those that are serious or organized criminal enterprises. The most prevalent are 
narcotics, money laundering, counterfeiting, financial crimes, crimes of violence and 
gangs. Financial crimes and gang activity were investigated at a significantly higher 
level than the other crimes. 

Addressing serious crime problems will help the fusion center garner 
support in the event of a need for local funding, or even sustained federal funding. Brian 
Banning takes the position that one way for fusion centers to show value is to “catch a 
bad guy.” This could be done with small investigative teams that would work tips the 
JTTF could not get to in a timely fashion or had passed on. These may be terrorist threats 
or major criminal cases. This team would work these cases as far as they could go. He 
feels some locally generated successes will go a long way to gain local and federal 
support for the fusion centers. He would also argue for a computer forensic capability 
within each fusion center. It is impossible to know if any terrorist intent exists in many 
criminal cases without opening up a computer. 87 


86 Marc Sageman, “Understanding Jihadi Networks,” Strategic Insight IV, Issue 4 (April 2005) Center 
for Contemporary Conflict, www.ccc.nps.navv.mil , last accessed January 4, 2008. 
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e. Prioritization 

In addition to prioritizing what level or amount of work is to be done 
between the strategic analysis and tactical case support categories, the fusion centers 
must have a system of prioritizing or triaging tips and leads. All of the tips and leads 
should get some level of at least a cursory review; however, the degree to which each tip 
or lead is pursued should undergo some sort of evaluative process. Indeed, without some 
sort of screening process or triage, fusion center intake could become overwhelmed and 
wholly ineffective. 

One system of triaging tips and leads to ascertain a weighted score for 
investigation priority was advanced by Raphael Brinner, an analyst for the U.S. Coast 
Guard. Brinner presented his model to the RTTAC Analyst Training Conference in 
Monterey California. In a brief overview of his model, as yet unpublished (presented 
here with permission), Brinner highlights the relationship between threats, vulnerabilities 
and incidents with individual domains in Venn diagrams. A full treatment of the model is 
beyond the scope of this thesis, but is presented as an area that should be addressed by 
fusion centers. The USCG approach is to measure suspicion using their MEDS 
(Minimal, Elevated, Demonstrated, Strong) threat rating system using the objectives of: 
1. highlight anomalies; 2. keep routine activity in perspective; 3. apply rigor to a 
subjective process. Key issues are to recognize your biases, set the activity in the local 
contexts, individual incidents are poor metrics (the sample size is too small), and local 
trends are more important that national trends (except for the aviation industry). Finally, 
triage, objective language, and investigation will give data context and meaning. 88 

With a triaging system in place, priority investigations can be targeted at 
the tips that are associated with known vulnerabilities, linked to suspected threats and 
involve incidents that are suspicious anomalies. 


88 Rafael Brinner, Analyst, U.S. Coast Guard, Maritime Intelligence Fusion Center Pacific, Triaging 
Suspicious Activity, a Model for Homeland Threat Analysis, February 2008. E mail provided with 
permission, Rafael.J.Brinner@uscg.dhs.gov. 
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3. Leadership 


As has already been stated the literature is very weak or silent on the issue of who 
should lead fusion centers. This may be because the federal government is sensitive to 
the concerns of local control and is unwilling to enter into a political arena that may be 
fraught with controversy; or it may be that — due to the varying needs and organizational 
structure of the state and local fusion centers — management, or more importantly 
leadership, is not fully developed in the aforementioned documents. In all likelihood, it 
is a combination of the two. As has been documented in numerous studies, however, the 
success or failure of any new venture, particularly a collaboration of different entities 
with different cultures, requires strong (not autocratic) leadership. The leader must be 
able to instill a vision and have the ability to translate that vision into several different 
dialects, if you will, to be able to talk to fire, law, public health etc. 

A leader taking on this type of challenge must be able to not only build and 
maintain relationships but intuit what relationships are necessary but do not, as yet, exist. 
This will necessitate establishing common modes of communication, but more 
importantly, creating a common desire or identification of a need to communicate — 
which will be made more even more difficult in light of the phenomena of the fading 
threat created by the length of time since we were successfully attacked. Such a leader 
will require an abundance of trust, competence and credibility. Successfully managing a 
fusion center into the future will require more than an intelligence professional or a 
skillful manager, it will require a leader with excellent networking skills. 

The vast majority of fusion centers have statewide responsibility. According to 
the CRS July 2007 report, many were originally state police agencies that were given an 
additional task of intelligence production, making them the fusion center. It is not a great 
deductive leap to make the conjecture that state intelligence centers or state law 
enforcement centers would be hierarchical in nature and lead with a top-down 
perspective. The regional fusion centers, which were less than 20 percent of the total 
number of fusion centers, were generally those that were located in UASI cities. The 
CRS report found that these regional fusion centers were more likely than the state 
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counterparts to have multiple agencies "involved in their development in day-to-day 
operational management." 89 If leadership, guided by networked relationships, is truly 
beneficial, the regional fusion centers that were forced into collaborative relationships in 
the developmental stages of their emergence may well prove to be the beneficiaries of 
necessity. 

It will be the burden of state agencies to move from the comfort of the known and 
entrenched style of leadership to adopt a truly collaborative and inclusive leadership style 
that will embrace a network philosophy. It will not be easy to give up total control but, in 
a catastrophic event, no one will have control and no single entity will have a chance of 
responding adequately. A diverse and reflexive network will be a necessity to respond to 
the threats of the future. 

B. ANALYSTS 

Staffing the fusion center is a critical function that is often overlooked or not 
adequately considered. The analysts selected to work in the fusion center must be 
selected on the basis of ability, capability and the mission of the center. Basically, two 
categories of analyst are assigned to fusion centers. The first is crime analysts (tactical) 
who generally have a law enforcement background. The second is intelligence analysts 
(strategic) who generally have a background in either the military or a federal intelligence 
service. Both require a level of training, education and expertise, but have distinctly 
different orientations in their approach and expertise. Intelligence analysts frequently 
have a higher level of formal education and perfonn predictive strategic assessments; 
crime analysts generally have more experience in case support and link analysis, and 
perform tactical or case support. 

From the IC's perspective, a strategic analyst, as described by Phil Bodenhom, is 
one who has a level of subject matter expertise that has been gained with years of 
experience. Strategic analysts must work from a basis of hypothesis and very often must 
rely on sketchy information that must be qualified by their domain of expertise and 


89 Masse et at, CRS report for Congress, 20. 


60 



knowledge of all aspects of the threat. This level of knowledge is required to make 
predications and assign degrees of confidence, which can take on the quality of peering 
into a “crystal ball.” This level of experience gives them the moral courage to make 
assessments — and stand by them. Conversely, some analysts do research on after-the- 
fact crimes or an incident; this is investigative research, not intelligence analysis. 90 

Frequently, sworn law enforcement officers and firefighters are chosen to 
function as fusion analysts. Often, these officers have little training or background for 
this position. The type of personality that is drawn into the field of law enforcement or 
firefighting is not generally consistent with the type of personality that is willing to sit at 
a desk all day and read copious amounts of material from disparate sources, recognizing 
patterns and integrating them into a potential threat pattern. That is a special skill that 
requires aptitude and training. We need to recognize and hire staff to that end. That is 
not to say that certain law enforcement officers, fire fighters or other emergency 
responders cannot make good analysts, just that the ability to be a professional 
intelligence analyst has a special skill set, experience and aptitude. Robert Galameau, co¬ 
manager of the LA RTTAC, gives his perspective on the issue of law enforcement 
analysts stating, “The more difficult analyst to work with is the law enforcement analysts. 
Cops as analysts are in an uncommon role and the transition is often difficult. Cops want 
to do things.” 91 

Another perspective on the issue is presented by Sheriff McGinness. Having 
specially trained analysts to provide continuity and historical perspective is useful and 
necessary; however, Sheriff McGinness also takes the position that having a law 
enforcement presence in the analyst pool adds value to the fusion process — and to the 
organization when the officer returns to his or her agency. The knowledge and skill 
gained in that assignment can have a beneficial effect on the organization. 92 
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Unlike some fusion centers, the Arizona AcTIC does not use any law enforcement 
or other emergency responder personnel as analysts. The analyst role is strictly a civilian 
position with its own career path. All of the analysts in the tactical analyst section of 
AcTIC have a minimum of a BA. Degree and, as part of the hiring process, candidates 
are tested on analytical thinking. 93 

Crime analysts require a professional background and training that cannot be 
accomplished with a two-year rotation common to many sworn law enforcement and 
firefighter analysts assigned to fusion centers. Further exacerbating the problem, of 
having rotating analysts, is the issue of clearances. To be effective, one must have access 
to classified databases. These are generally controlled by the FBI, who has the 
jurisdiction to investigate crimes of terrorism. Access to these databases cannot be 
granted without a top-secret, secure, compartmentalized information (TS SCI) clearance. 
From the date of application, it takes approximately one to two years to gain this 
clearance (it has been reported that this timeframe is being driven down to as fast as nine 
months in some jurisdictions). 94 Given the time it takes to select, train and obtain a 
clearance for an analyst, if a fusion center were to rely on sworn officers or anyone else 
that must rotate on a two- to three-year basis, one can be certain that the effectiveness of 
the analytical capability of that fusion center will be significantly degraded. If a fusion 
center has a rotation or retention issue with analytical staff, they will perpetually be in 
training, pending a clearance, and lacking any historical perspective. 

To illustrate the point the LA RTTAC has approximately nineteen analysts. Ten 
of them are from LASO or LAPD. They have lost nine analysts in the past year-and-a- 
half due to turnover. It takes about nine months to get an analyst a top-secret clearance, 
and then they have to train them on the databases and the process of intelligence. They 
are perpetually in the training mode. 95 As reported in the survey data, of the five 
California fusion centers, two of them had less than 50 percent of their staff with 
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clearances to access classified databases, and two more had between 50 and 75 percent of 
their staff with access to classified databases. 

A confidential source, with ten years of experience in the intelligence analysis 
field, gave the opinion that the vast majority of the analysts in the fusion centers in the 
RTTAC and the STTAC were crime analysts and lacked the experience, education and 
skill set of an intelligence analyst. This was chiefly borne out in their product, which 
lacked both quality and quantity. The significant issue was that the products reported 
observations but did not produce an analysis of the observations or predictions. The 
products were too few and lacked recommendations that could direct policy. The source 
praised the fusion center analysts, which were primarily criminal analysts, for their 
criminal or tactical case support. It was felt that much more experience and education 
was needed before these criminal analysts could be considered intelligence analysts. It 
was also acknowledged that there was less call for “strategic” analysts by the current 
caseload. The majority of the analytical work was accomplished at the tactical case 
support level, which was where the majority of the analysts had their greatest strengths. 
The sources also mentioned that a lack of threat data inhibited the depth of their work 
product. 

The question was also raised as to whether there was enough demonstrated benefit 
to sustain the fusion centers if they did not produce some material benefit for an 
identified customer base, considering the high cost of operation. 96 

1. Training 

According to the survey, three of the five fusion centers had over 76 percent of 
their staff trained in intelligence analysis. One of the fusion centers only had 26-50 
percent of staff trained in intelligence analysis, but it is still in the developmental stages. 
The most commonly reported training that the analysts received was the Foundations of 
Intelligence Analysis Training (FIAT) from the International Association of Law 
Enforcement Intelligence Analysts (IALEIA), which is a non-profit professional 


96 Personal communication with a confidential source who is a career intelligence analyst. 
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organization dedicated to advance law enforcement intelligence analysis. The other 
major provider of analyst training is the Law Enforcement Intelligence Unit (LEIU). 
LEIU is an association formed to promote criminal intelligence analysis; as laudable as 
their goal, they have no mandate to enforce or sanction for a lack of standards. 

The issue of requirements for training is dependent on the type of analyst one is 
considering. The educational requirements that the intelligence community in the FBI or 
DHS considers qualified for an intelligence analyst is at a bare minimum, a bachelor's 
degree in a targeted major and most likely a masters degree or Ph.D., with some work 
experience, and possibly language abilities or cultural experience. Training programs for 
these individuals exist within the FBI and CIA, but these programs focus on honing 
existing skills. Analytical training for criminal analysts would require much less formal 
education, but many of the same skills in critical thinking; these requirements are in 
addition to the ability to conduct tactical case support utilizing link analysis and other 
investigative tools. 

In the infonnal phone survey conducted by the Sacramento Joint Powers 
Authority, the twenty-one fusion centers that responded to the survey identified analytical 
skills and writing skills as the area where their analysts needed the most improvement. 
Eighteen of the twenty-one centers stated that their analysts had received some training in 
analytical thinking and analytical tools. The training that was identified as most needed 
included: analytical skills, terrorism fundamentals, report and analytical writing. Other 
identified training needs included identifying reportable intelligence, intelligence 
methodologies, open-source exploitation, anticipating law enforcement needs, 
advanced research skills, and analytic tools. 97 

What is lacking is a government-sanctioned analyst training program to 
standardize training regimen and requirements (this comment is not to infer in any way 
that either of the above organizations is anything other than professional). However, 


97 Sacramento Joint Powers Authority. 
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these professional organizations would benefit from having the support of a government 
agency with adequate funding, rather than relying on nonprofit status or other means to 
support this necessary training. 

This sentiment is reinforced by RTTAC co-manager FBI Special Agent Steve 
Oda when he makes the observation that we do not have a robust national training 
program to take people from an undergraduate degree to a trained analyst. The FBI and 
DHS have training that can take an existing analyst with a master’s degree or Ph.D. and 
develop those skills. But no program currently exists to take someone from 
undergraduate to analyst of a standard recognized by the intelligence community. Steve 
Oda went on to say that one or two quality analysts make a tremendous impact within the 
fusion center. 98 

Brian Banning, the former Deputy Commander of the Sacramento RTTAC, felt 
that the crime or tactical analysts were very well-trained; in fact, he described them as the 
most trained group he has ever worked around. He added that the training lacked 
standardization, but that efforts appeared to be underway between the major providers to 
establish formal standards. Banning took the same position as others in identifying two 
distinct groups of analysts — the tactical versus the intelligence or strategic analyst. He 
identified the intelligence analyst as being capable of looking at geopolitical trends and 
applying that perspective to our region to make predictions on local potential for groups 
or individuals. He noted that there is a difference in the product between the two groups 
of analysts. 99 

The confidential source also felt as though there was plenty of good criminal 
analyst training available, there was very little “all source” strategic analyst training 
available, outside of Washington DC. The source felt that there is no identifiable vehicle 
for local analysts to gain the necessary training to become a strategic, all-source 


98 Oda, interview. 

99 Banning, interview. 
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intelligence analyst. It was recommended that perhaps mobile training teams from 
accredited training facilities in Washington, DC, provide the necessary training to 
upgrade local analysts’ skills. 100 

Analysts, strategic analysis in particular, must be able to articulate how likely they 
think a thing is and to what degree they have confidence in their assessment. In other 
words, they need to be able to say something along the lines of, “We think it is very 
likely that this is going to happen,” with a high degree of confidence, or say that “we feel 
that this is very unlikely, but we have a low degree of confidence.” Strategic analysts 
need to be able to have confidence in the accuracy of their opinions. This is so because 
their assessments are judgments, not fact, and they need to be able to withstand political 
pressure to manipulate the outcome of their assessments. Analysts need to have the 
courage of their convictions and the character to stand by them, even when pressured to 
"re-evaluate" their assessment. Appropriate education, not just training, will help provide 
the needed confidence. 

One complaint — commonly brought up throughout all the interviews related to 
analysts and their training — was the accessibility of databases. It is not unusual for an 
analyst to have to run over fifty different databases to complete an investigative check on 
a tip or a lead. There are efforts underway (Cop Link) to integrate the various 
jurisdictions’ record management systems so that one query could run all the databases. 
Everyone queried on this point energetically supported this concept. It was also 
discovered that a civilian contract analyst retired from law enforcement with a top-secret, 
secure compartmentalized information clearance (TS SCI) could not access the California 
law enforcement teletype system (CLETS), but a entry-level clerk in any law 
enforcement agency would have unrestricted access to the same database. 101 


100 Personal communication with a confidential source who is a career intelligence analyst. 

101 Mike Sena, Commander, Northern California Regional Terrorism Threat Assessment Center, 
interview, November 19, 2007. 
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C. INTELLIGENCE DISSEMINATION 

Dissemination has two distinct and very important components. The first is who it 
is disseminated to, the second is how it is disseminated. Possession of intelligence has no 
value unless that intelligence gets to people who can put it to use. Therefore, it is 
important for intelligence to reach as wide a range of personnel as possible without 
compromising the integrity of that information, particularly sources and methods. There 
is some controversy in the emergency responder community about the dissemination of 
unclassified infonnation. 

Many documents are prepared and released at the Law Enforcement Sensitive 
level (LES) while others are prepared and released at the For Official Use Only level 
(FOUO). The distinction is that firefighters and other non-law enforcement emergency 
responder partners will be unable to receive LES distributions, while all in the ER 
community should be clear to receive FOUO information. The release of material at the 
LES level has caused some dissension between the fire and law communities. 

Three main issues are raised in the FOUO/LES controversy. The first issue is 
need to know; the producers of some intelligence product feel some information that they 
produce should be restricted to law enforcement on a need-to-know basis to protect 
aspects of the inquiry or investigation. The counterargument is that LES distribution is 
so widely disseminated, with no true legal controls, that this information is compromised 
as soon as it is disseminated. 

The second issue is one of cultural differences between law enforcement and fire 
personnel. The argument goes that law enforcement is more familiar with investigations 
and the need for secrecy and confidentiality, whereas fire personnel who have not been 
exposed to the cultural need for secrecy are less concerned with controlling the access of 
information to unauthorized recipients. This position is generally supported by anecdotal 
reports, which can cite violations in either camp. An illustration is the position held by 
Tim Johnstone, Sacramento RTTAC Commander, when he said that we needed to vet the 
product to the audience. Cops will continue to get a higher degree of information and 
intelligence, and there will be a need to scrub intelligence for fire to get what they need 


67 



without worrying about the loss of secrets. He also noted that it was just a function of 
education and time before the fire personnel were where they needed to be on 
information security and control. He also cited an incident in which a fire department 
employee released a FOUO document to the local press, which caused some concern and 
tension. The problem was addressed and has not recurred. 102 

The third issue is created by what is called originator control. This is the 
principle that if an agency or entity produces and disseminates information or intelligence 
at a certain level, that information or intelligence cannot be disseminated at a lower level. 
Therefore, if a local agency receives information at the LES level, they have no recourse 
but to honor that level of classification and disseminate at the same level. It is possible to 
go back to the originator for permission to re-class. This is a timely process, however, 
and a rare occurrence, as most infonnation is time-sensitive. 

Greg Ladas, TLO administrator for the Sacramento RTTAC, agrees that these 
issues cause problems with dissemination. The Sacramento RTTAC Fire and Law TLOs 
currently receive e-mail distributions of intelligence, but they are on different lists to 
respect the handling caveats associated with different distribution levels, specifically LES 
and FOUO. Ladas stated that even though there are not legal sanctions the intelligence 
community is one of trust, and if a center does not respect the handling caveats they will 
be shut off from further intelligence. A common problem with dissemination, most 
frequently associated with federal documents (although the problem is widespread), is the 
dual labeling of a document with LES and LOUO. This dual labeling precludes the 
dissemination of this product to anyone other than law enforcement, which restricts the 
audience and potential effectiveness. 

Another related problem that is frequently cited is that of over-classification of 
documents. Ladas mentioned that this is a common problem, which he attributes to 
misunderstanding the need or audience; also, a fear of classifying a document too low 
leads some to automatically classify at the higher level. 103 

102 Johnstone, interview, November 29, 2007. 

103 Greg Ladas, Sergeant, Sacramento County Sheriff s Department, RTTAC TLO Manager, 
interview, January 3, 2008. 
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The survey data gives weight to the need to resolve this controversy. Two of the 
five fusion centers produce between 25 and 50 percent of their product at the LES level, 
and a third fusion center produced 50 to 75 percent of their product at the LES level. The 
remaining two fusion centers produce between 10 and 25 percent of their product at the 
LES level. It is clear that a great deal of information is being produced and disseminated 
at the LES level. It would be in the best interest of an “information sharing environment” 
to minimize LES dissemination unless it is absolutely called for. While there is a need 
for LES products, guidelines for the decision to disseminate at the LES level vs. the 
FOUO level should be developed and enforced so that this classification is not being used 
out of habit or out of cultural bias. 
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IV. ANALYSIS OF CURRENT PRACTICES FOR DATA 

COLLECTION 


A great deal has been written about fusion centers and the need to involve our 
emergency responder community, particularly law enforcement. Much less has been 
written about how we are actually going to engage this community of responders. What 
is clear is that for local fusion centers to produce locally relevant and actionable product, 
they will need to gain as complete a picture as possible, which will require the collection 
of information by local emergency responders. This information may be the result of a 
vehicle stop, a community contact, a building inspection, or an emergency medical 
response. The ER community needs to be aware that it has the “duty as assigned” to be 
observant for “indicators,” and then relay that information. 

The majority of recent attempts by radical jihadist terrorists were the result of a 
domestic cell. These threats come in many forms, such as radicalized prisoners, 
homegrown jihadists motivated by the al Qaeda ideology, environmental terrorists, and a 
host of single-issue terrorists such as Timothy McVeigh. Both the federal partners and 
the state and local partners have significant contributions to make toward providing for 
the collective security of the homeland. These partnerships will be optimized by personal 
networks and collaborative partnerships that reduce and/or eliminate duplication, and, by 
relying on each other’s strengths, produce a far better prevention posture than that which 
could be accomplished independently. 

While there are hundreds of thousands of law enforcement officers across the 
country, we must not be blinded to the potential contribution of the rest of the emergency 
responder community, particularly fire, EMS and public health. Also, law enforcement 
must overcome the bias that they alone have the absolute responsibility and obligation for 
the domestic protection of the nation. The fire service particularly, but also the medical 
field, public health and the many other disciplines within the emergency responder 
community possess a wide variety of opportunities for interaction and intelligence 
collection. It will take more than inclusion by the law enforcement community to exploit 
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these resources. The culture of many of these resources is geared toward patient privacy 
and is counter to intelligence or information collection. This area requires attention and 
education. 

A. EMERGENCY RESPONDERS 

Data collection for emergency responders is an under-appreciated and under¬ 
utilized resource. Homeland Security strategies are resplendent with references for the 
need to have law enforcement and other responder disciplines collect information, but 
there is little concrete or readily available data to show where or how that is being done. 
That this is important, there can be little doubt; what is in doubt is how to achieve this 
end and what results have been garnered with what programs. 

If one accepts the premise that data collection for ERs, from either an all crimes 
or purely terrorist (transnational or domestic) perspective can support the protection of 
our country or materially assist in a prevention mode, then one must look to what 
methods are best utilized to collect this data. Law enforcement has the distinction of 
generally having primacy in the role of managing fusion centers, as well as participating 
in other aspects of the counterterrorist effort on the domestic home front. Even with that 
perspective, law enforcement still faces the challenge of reporting relevant information in 
a timely fashion that may lead to the interdiction or disruption of a terrorist act or plot. 

To rectify the situation, the ER community needs to be sold on the value of local 
fusion centers and the value added potential that they posses, as well as the need to be 
observant, have sufficient situational awareness to be aware of what to report and have 
appropriate reporting mechanisms. A re-occurring theme, that has played itself out 
several times, is to create a need amongst the emergency responder community that their 
input has value, and indeed, may be necessary. Many sources have cited terrorism 
fatigue — or the long gap in time since our last domestic attack — as a potential causal 
factor for the ER community to be less than diligent in their observations of potential 
terrorist activity and/or reporting it. 
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1 . 


Value of ER Data Collection 


The results from survey clearly show that fusion centers receive the majority of 
their source data from local agencies. The survey also reported that 80 percent of the 
fusion centers felt that the ER community is not being appropriately utilized as a data 
source. FBI’s Steve Oda, LA RTTAC co-manager, supports these conclusions stating that 
the value of the ER data collection is huge and that to collect local ER data, the LA 
RTTAC utilizes the TLO program, which is a big priority within the RTTAC. Oda feels 
the TLO program was very much a work-in-progress as were, probably, most others. He 
believes that the RTTAC was undoubtedly missing out on intelligence and that to counter 
that they are engaging in a vigorous education program, attempting to recruit and train 
more TLOs, formalizing the training, creating more outreach, particularly outside the 
county of LA, and finally, redoubling their efforts to ensure feedback to those reporting 
information. One way they have done this has been to assign every tip a tracking number 
to ensure feedback and to enhance the ability to connect follow-up tips. 104 

The value of ER data collection was also underscored in the recent analyst 
training in Monterey. The group consensus of the analysts attending the training was that 
the analysts assigned to the RTTAC and the STTAC could not produce an intelligence 
estimate for California because they lack sufficient threat data. One of the key areas that 
they felt they were lacking was data from the field. The non-reported incidents were felt 
to be a significant area that created a hole in the threat picture. 105 

Phil Bodenhorn, FBI FIG supervisor, reinforces the need for first responders to 
collect data that he describes as “crucial.” He goes on to describe first responders more as 
“first preventers” who need to be made aware of standing intelligence requirements in 
order to maximize the opportunity to gain as much information as possible, declaiming 
“our net work must be theirs.” 106 


104 Oda, interview. 

105 Analyst Training Seminar, Monterey, California. 

106 Bodenhorn, interview. 
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2. Establishing a Need 


There is the appearance of a sense of complacency that has settled over the 
country, due in part to the gap in attacks, and also, in many respects, to the fact that local 
administrators, and the ER community as a whole, may feel that a terrorist event will not 
occur in their jurisdiction. Even in the law enforcement community, which is arguably 
more prone to supporting and reporting terrorist-related activity, there has been a deficit 
in any feeling or understanding of the need to report terrorist activity. In fact, many chief 
executives of law enforcement agencies have expressed the desire for greater 
intelligence on criminal gang activity in their jurisdiction rather than that of counter¬ 
terrorist information. 107 

That a threat continues to exist is, as some have called it, a predictable surprise. 
The eventuality of an attack is almost certain, but the where and the how are unknown. 
This position is supported by Brian Jenkins, in his testimony before the House of 
Representatives when he said: 

But, we have not prevented jihadist leaders from communicating, blunted 
their message, or effectively countered their ability to radicalize and 
recruit angry young men. Our attention must the shift to local 
conspiracies, which may operate below our intelligence radar. This 
increases the importance of domestic intelligence-collection and the role 
of local police. 108 

To establish an acceptable level of “need” within the ER community, homeland 
security professionals will have to educate the public, administrators and the ER 
community without creating a sense of fear or foreboding. This education should also 
incorporate a realistic expectation of homeland security prevention and not entrap the 
protection mission with the myth of being able to stop all attacks. Everything is subject 


107 Police Executive Research Forum, California Focus Group on Fusion Centers Agency Fleads 
Meeting, Norwalk, California, August 30, 2007, Executive Focus Group. Several of the executives at this 
meeting voiced concern for criminal intelligence, particularly gang intelligence as a greater need than 
counterterrorist intelligence. 

108 Jenkins, testimony before the Committee on Appropriations Subcommittee on Homeland Security 
United States House of Representatives, January 30, 2007, 1. 
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to prioritization and we cannot let terrorists bankrupt our economies or our way of life by 
trying to prevent every foreseeable eventuality. 

It is also appropriate to recognize and address the need for ER administrators to 
enhance their information sharing and investigative capabilities in regional threats such 
as gangs, narcotics, financial crimes and other major types of crime impacting local 
communities. Chief Braziel expands on this by offering known threats that have a 
regional base of operations and are a physical threat to the community. He feels that a 
regional and targeted gang analysis, by the fusion center, would generate a sense of need 
and involvement from the line-level law enforcement officers and their administrators. 
This base of support and success could be used to further counter terrorist efforts by 
demonstrating a locally actionable product. 109 

3. Situational Awareness 

One way to demonstrate the need described above is to educate elected officials, 
ER administrators and the ER community on situational awareness. Hand-in-hand with 
developing a need to report is knowing what to report. Having too much data reported 
can be as bad, and maybe worse, than not enough data. It would be counter-productive to 
create a suspicious atmosphere, in place of an informed one, that encouraged 
stereotypical reporting. Ill-informed reporting may not only overwhelm the system, but 
alienate those that have done no wrong, creating fear and mistrust in those we want most 
to trust us. The ER community needs to be educated about what pre-incident indicators 
are, with examples, and gain an overall situational perspective on terrorist operational 
methodology so that they may be alert for behavior, literature, or items of interest. 

The vast majority of ERs will notice whether something is amiss; we just need to 
provide them enough education to give context or form to what they are seeing. The 
level of education that we are speaking about will not require a significant amount of 
time; what is required is enough information to give the emergency responder community 
confidence to report suspicious behavior. The ER community, particularly the non law 


109 Braziel, interview. 
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enforcement community, needs to recognize that forwarding a tip is not an indictment, 
and that no onus is attached if an observation turns out to be merely innocent behavior. 
Situational awareness training can be provided in one-day classes, seminars, roll-call 
training or online, and need not be done all at one time. Indeed, this education should be 
considered a perishable skill and refreshed, perhaps annually. The training could be 
reinforced with the use of terrorism liaison officers, which will be discussed below. 

As has been reported the evidence from the survey indicates that the lack of 
situational awareness by the ER community is a problem. Lt. Johnstone, Sacramento 
RTTAC commanders’ observations on his assessment of the regions situational 
awareness are evident in his comment: the situational awareness for law enforcement is at 
a bare-bones level. And it's even worse for the emergency responder community. 110 

4. Reporting Mechanism 

It is interesting to note that the responders to the survey stated that reporting 
mechanisms are available and user-friendly, and that there is potentially valuable 
information residing in the ER community, but that the ER community seems to be 
failing to take advantage of reporting opportunities. It is quite possible that the reporting 
system is not as user-friendly, available or widely known as the fusion center managers 
had hoped. (It is also likely that poor situational awareness has contributed to the under¬ 
reporting). 

Once a member of the ER community has infonnation that he or she feels should 
be reported, he or she can use one of several methods to report potential terrorist activity. 
Currently, most tips can be reported on 800 numbers, fusion center-sponsored websites, 
terrorism liaison officers (if one exists in your agency), a terrorism early warning group 
(if one is available to you), via the nonnal reporting procedure in your local law 
enforcement agency, or directly to any FBI field office or agent. 

Due to the specialized nature of terrorism, many of the earlier versions or methods 
of reporting terrorism were conducted along the lines of social networks. While social 

110 Johnstone, interview. 
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networks are critical, they need to be bolstered with sufficient technology to ensure rapid 
and seamless reporting that does not rely on an individual, which may become a single 
point of failure in the reporting chain. During the course of conducting interviews for 
this thesis, it was reported that a tip from a TLO was left on a desk and was not acted on 
until after the subject, who was on a watch list, left the country. 

Two of the fusion centers, the Los Angeles JRIC (RTTAC) and the Northern 
California RTTAC both have websites that have a link to a tip and lead fonn that can be 
filled out online and sent in to the fusion center. This method appears to be working well 
and has great promise and capability, including the capability for the public to send in 
tips or leads. One problem with this is that the local TLO officer will very likely not 
have any infonnation on activity that may be happening and reported on in his or her area 
of responsibility. 

The Sacramento RTTAC currently uses the TLO program as their primary means 
of conducting education and awareness about the program, as well as relaying tips and 
leads from the field to the fusion center. One problem with this is, as stated above, this 
can create a single point of failure. If the TLO that the officers are used to working with 
is on vacation, takes days off, or transfers, that information may not be relayed in a 
timely fashion, or at all. The Sacramento RTTAC is exploring a website reporting 
systems similar to the Northern California and the LA RTTAC’s system. 

Another problem common to most reporting mechanisms is how does one report 
suspicious activity to one's own investigative unit as well as to the fusion center? If the 
tip is not obviously terrorism, merely suspicious, but is clearly a violation of the law, a 
financial crime for example, how would one report that information so that both agencies 
remain aware of the potential crime? Also, how does one remove the conflict for the 
potential for duplication of investigations and interfering with each other's investigation? 
An additional problem is that law enforcement officers and others in the ER community 
may reduce their level of reporting if they have to report the same information multiple 
times to different entities. 
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Closing the loop on reporting tips and leads to the RTTAC is feedback from the 
RTTAC to the tipster. Each of the RTTAC commanders that were interviewed felt 
strongly about getting feedback to the emergency responder (generally fire or law) that 
made the referral. While not all had a fonnal process, it was a matter of standard 
operating procedure to acknowledge those who provided infonnation. The LA RTTAC 
has a unit whose responsibility it is to perfonn this function, the Investigative Liaison 
Unit. The LA RTTAC also publishes a weekly “Tips and Leads” sheet that shows what 
tips have come in as a way to share information and generate interest, as well as 
acknowledgement. 111 

B. DATA COLLECTION 

1. Terrorism Liaison Officer (TLO) Programs 

If fusion centers are to operate as effectively as they can, they will need to have 
timely data that is collected locally. One method would be to use the law enforcement or 
emergency responder community as data collectors. That raises the question: How do 
you train an entire police force, nationwide, on pre-incident indicators? How do you keep 
those perishable skills current in an environment that will rarely allow the officer to 
practice what he or she has been taught? One answer is the TLO program, which 
provides for a few officers to receive in-depth and recurring training to function as a 
resource or a point of contact for other officers in his or her department. 

a. Overview of Sacramento RTTAC TLOs 

The Sacramento Regional Office of Homeland Security (SROHS) and the 
Sacramento RTTAC facilitated a forty-hour training course for TLOs within the RTTACs 
region (34 counties & 88,000 square miles) that hundreds of officers attended. One year 
after the program, the RTTAC was still receiving a minimal number of tips or leads from 
the officers that had undergone the training. A complete review of the training and 
program was conducted. The training course itself was judged to be superior (although 

111 Galarneau, interview. 
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some modest changes were made to the course). The training program consisted of a five- 
day overview and situational awareness of domestic and transnational terrorist 
methodologies and ideology. The course content was thorough, well received and well 
rated. 

An objective review of the program revealed several shortcomings. First, 
the TLO training was rolled out ahead of the TLO program itself. Secondly, agency 
administrators within the RTTAC region were largely unaware of the program, did not 
know the benefits of the program or what the expectation for their participation might be, 
or, what level of commitment would be expected. Third, the training was announced via 
the nonnal training announcement system, and officers self-selected to go to the training 
without administrative support or time commitments. Fourth, what was not included in 
the curriculum was how the TLOs were to operate within their own agencies or in 
relation to the RTTAC. What had been done gave the officers a fine orientation on 
terrorism and then sent them back to their agencies without adequate support or 
operational instruction. According to Tim Johnstone, the RTTAC Commander, training 
had been provided to 475 TLOs without adequate forethought, as a knee jerk response to 
the need to provide and collect intelligence. A re-organization was in order. 

The Sacramento RTTAC collaborated with the U.S. Attorney's Office 
training coordinator for the U. S. Eastern District for California, Jim Day. Jim Day had 
spent the majority of his career in the thirty-four counties of the RTTAC jurisdiction and 
knew almost every chief of police and sheriff in that region. With his assistance, the 
RTTAC, represented by Lt. Tim Johnstone, Sergeant Greg Ladas, and Jim Day scheduled 
appointments to meet with the chiefs of police and sheriffs in virtually every jurisdiction 
within thirty-four counties to explain the program, its potential benefits and the level of 
commitment (which was minimal) that would be required for their agency to participate. 
Because of this level of personal outreach, the program was well received and a much 
greater degree of commitment and involvement was gained from the law enforcement 
executives. The head of each law enforcement agency that was participating in the TLO 
program was asked to nominate a candidate. This way, it was felt, the TLO program 
would have a greater buy-in from the agencies, since they had a direct hand in selecting 
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the personnel that would become the TLO officers and represent their agency. And, 
perhaps more importantly, it was expected that agency heads would nominate a candidate 
that they had confidence in, and they would be able to fulfill the role of liaison to the 
agency's administrators, in addition to acting as a point of contact and reference for front¬ 
line officers. In support of this, Greg Ladas stated that agency heads would often say 
something similar to: I didn’t know this person was a TLO; he is not a good fit for our 
agency. Once personal contact was made, and expectations and commitments were made 
clear, the program support increased appreciably. 

The original TLO training course was forty hours. The course was 
shortened to twenty-four hours and a separate, stand-alone one-day course was added to 
the program. The one-day course consisted of an orientation to the TLO program and it 
trained the officers on how to function as a TLO. The roles and responsibilities of the 
position were outlined and they were given guidance in how to liaison with their 
administrators, how to interact with the line level officers, and how to interact with the 
RTTAC. The TLOs received training in the handling of sensitive infonnation and in 
reporting tips and leads. The role of the Sacramento TLO was to be a point of contact 
and a resource for the line officers, conduct roll call training, be a conduit to relay tips 
and leads from the officers to the TLO coordinator (who in turn relays that infonnation to 
the RTTAC), and act as a liaison to their agency in matters regarding terrorism. Prior to 
the training, the RTTAC had sent out a form for each agency executive to nominate the 
TLO; these had to be provided to RTTAC at the time of TLO training. The TLOs were 
also required to sign a nondisclosure agreement stating that they would handle the FOUO 
and Law Enforcement Sensitive (LES) infonnation as had been instructed in class. 

The reporting system for tips and leads in the Sacramento RTTAC 
consists of officers or line-level personnel who discover information that does not require 
an immediate response to report that information to the TLO. (Each county will have at 
least one TLO coordinator and several TLOs). The TLO will report tips and leads to the 
TLO coordinator who will then relay that information to the RTTAC. 

TLOs were also encouraged to establish terrorism early-warning groups 

(TEWG) within their counties. They received basic information on the TEWG concept, 
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with more training scheduled for the future. TLOs were also encouraged to attend, and 
offered priority reservations, for training in the Automated Critical Asset Management 
System (ACAMS) and the Enhanced Threat and Risk Assessment (ETRA) class. Once 
the TLOs receive this training, they will be encouraged to conduct ACAMS assessments 
in their jurisdictions on critical infrastructure. The RTTAC maintains a list of critical 
infrastructure locations that will help TLOs identify and prioritize sites that need 
assessments. 

The Sacramento RTTAC TLO program is approximately six months into 
this re-organization. While the program still has some hurdles to overcome, there has 
been a noticeable increase, not only in the quality, but in the quantity of tips and leads. 112 

The Sacramento RTTAC has a re-vitalized Fire TLO program underway 
as well. Sacramento Metro Fire Bn Chief Mark Wells and Captain Scott Cockrum have 
formed a working group to determine what information fire administrators and 
firefighters need, and how best to relay that information. The group is also developing a 
reporting format for firefighters to forward tips and leads to the RTTAC. Currently, the 
system is informal and handled on a case-by-case basis. By involving the fire community 
in identifying their own needs and procedures, a greater degree of involvement and 
support is anticipated. They are also reviewing the consumption potential for the 
firefighters and administrators. At what rate, and how much intelligence is needed, and 
how will it best be assimilated are the issues they are dealing with. 113 Most fire 
departments also have HIPPA issues, as many of their personnel are also EMS and have 
additional reporting restrictions (which will be discussed below). 


112 Personal communication throughout most of 2007 with RTTAC Commander Tim Johnstone, TLO 
coordinator Greg Ladas, Metro Fire Captain Scott Cockrum, and U.S. Attorney training coordinator Jim 
Day. 

113 Mark Wells, Bn, Chief Sacramento Metro Fire Department, TLO Coordinator, interview, 
December 20, 2007. 
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The Public Health Department, which has representatives co-located in the 
same facility as the RTTAC, is in the very beginning stages of developing a TLO 
program in the public health EMS/medical field. This program will establish a TEWG 
within the public health/medical community. 

One of the identified shortcomings of the Sacramento TLO program is the 
reliance on the TLOs as a conduit for the tips and leads from the officers making 
observations to the TLO coordinator and to the RTTAC. First, information is fourth hand 
by the time it gets to the RTTAC. Secondly, the reporting system is a single chain of 
individuals with no redundant or back-up reporting mechanism. Any point in the chain 
could be a point of failure and the infonnation would not be received. In the event a TLO 
or TLO coordinator was on vacation, had days off, was unmotivated or overloaded with 
other duties, the potential for a tip or lead to be delayed, misplaced or simply not 
forwarded is quite likely. Third, turnover of TLOs, due to rotation of assignments and 
promotions, will make it difficult for the line officers to know exactly who their TLO is 
at any given time. The turnover issue will also make it difficult to keep an adequate 
number of TLOs to facilitate the unimpeded flow of information. 

A recognized potential solution would be a web-based reporting system 
similar to that which the Los Angeles RTTAC (LA JRIC) and the Bay Area RTTAC 
currently use. Both systems are widely available, not only to the ER community, but also 
to the public, and are quite simple to use. 

b. Overview of the LA TLO Program 

The Los Angeles TLO program is operated out of the LA RTTAC or the 
LA JRIC (the LA fusion center was originally called the Joint Regional Intelligence 
Center, JRIC and the terms have become synonymous). Prior to the TLO program, 
information-sharing relating to terrorism was conducted on a personal relationship one- 
to-one basis, which is clearly not efficient in a jurisdiction the size and complexity of Los 
Angeles. The TLO program has expanded from Los Angeles County to include a total of 
seven counties; in addition to LA County, the RTTAC represents Orange County, Santa 
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Barbara County, Riverside County, San Bernardino County, San Luis Obispo County, 
and Ventura County. There are over 200 TLOs in the Los Angeles PD and Los Angeles 
County Sheriffs Department. The LA RTTAC supports approximately 500 TLOs. 

With only one law enforcement TLO coordinator for the entire RTTAC, 
individual personal contact is severely limited and restricts the role of the LA RTTAC TLO 
coordinator from facilitator to one of administrator. This lack of personal contact is being 
mitigated by establishing lead TLOs for each of the eight mutual aid regions within the 
jurisdiction of the RTTAC to act as local coordinators. Each county within the RTTAC has 
also designated TLO coordinators to facilitate the program. These TLO coordinators 
facilitate the program and give local agencies a local contact that is seen as one of their own 
and not a remote figure from a “parent” agency. The dissemination of information from the 
RTTAC to the TLO is conducted via e-mail groups. It is the responsibility of each individual 
TLO to serve as a point of contact and/or reference to officers in his or her department. 
Reporting back to the RTTAC is done via the website www.tlo.org . The website has 
graduated access from public domain to restricted to TLOs requiring a log-in. There is also a 
link for public reporting. 114 

To minimize any potential loss of intelligence, the LA RTTAC has tried to 
establish TLOs in most significant investigative units, generally the detective sergeant or the 
lead detective. The intent is that as they review incoming reports, they can make note of 
information that may be relevant to the RTTAC and forward that information.^^ As with 
many other agencies, and exacerbated in a program the size of LA’s, maintaining a 
knowledgeable and trained cadre of TLOs will be an ongoing challenge. The turnover and 
lack of training was apparent in a forum sponsored by the Police Executive Research Forum 
at the LA RTTAC, which was attended by TLOs in the LA region. Many of the 


114 Pete Jackson, Sergeant, LA County Sheriffs Department, LA RTTAC TLO Coordinator, 
interview, December 3, 2007. 

H5 Galarneau, interview. The overview of the LA TLO program is based on the interview with LA 
RTTAC co-manager Robert Galarneau and LA RTTAC TLO manager Pete Jackson. 
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TLOs that attended the meeting had not yet received any specialized training and several 
TLOs had just been given the job with very little understanding of what the job was or how to 
do it. 116 


c. Overview of the Northern California (NC) TLO Program 

The Northern California (Greater San Francisco Bay Area) TLO program 
is organized in a fashion similar to the LA and Sacramento programs. In the NC TLO 
program, officers volunteer for the position and get approval from their chain of 
command. Briefing information and bulletins are made by way of postings to their 
website, which requires a log-on for different levels of access. The website, 
www.ncrttac.org, also serves as a reporting mechanism for tips and leads from the TLOs 
as well as the public. However, the NC RTTAC TLOs do not receive bulletins or 
briefing information via e-mail as San Francisco police officers do not have e-mail 
accounts. In order to mitigate this obstacle, the NC RTTAC utilizes an alerting network, 
Roam Secure alert network. This commercial system sends out paging notifications on 
emerging events or other bulletins. 

The NC RTTAC is experiencing the same problem with TLO turnover as 
the other jurisdictions. They are finding a need to constantly train TLOs. The RTTAC, 
according to Commander Mike Sena, feels that they are losing information as there are 
break-downs in the system, particularly with so many different responder jurisdictions 
and disciplines, each with their own distinct cultures. 

The role of the NC RTTAC TLO is to act as an intelligence liaison officer; 
the goal is to create informant networks. Getting the ER community to respond has been 
slow but it is a necessary task. Sena feels that the lack of recent successful attacks has 
minimized the priority for observance and reporting in the mind of the public and the ER 
community, stating, “We need to educate without terrifying them.” 117 


1111 Police Executive Research Forum, personal observation. 

117 The overview of the NC TLO program is based on the interview with the RTTAC commander 
Mike Sena. 
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d. Overview of the San Diego TLO Program 

The San Diego TLO program falls under the purview of the RTTAC along 
with critical infrastructure protection and analytical strategic support for the region. The 
program is currently under reorganization. A year ago, the program was very disjointed 
and not very well structured. The San Diego RTTAC is now assuming responsibility for 
organizing the program and is focusing first on law enforcement, and will then direct its 
efforts toward fire, EMS, public health and finally, the public sector. Virtually every law 
enforcement agency in the San Diego RTTAC jurisdiction has a representative in the 
TLO program. 

One of the main functions of the RTTAC is to support the TLO program 
and the TLOs. This support is in the form of providing information and intelligence to 
the TLO officers who, in turn, are expected to provide that information to the officers 
within his or her department. Information comes in the fonn of bulletins with specific 
information and strategic pieces of intelligence that describe trends and more generalized 
intelligence. 

TLOs are not expected to be investigators or even infonnation collectors 
per se, but are expected to “push and pull” infonnation between the field and the 
RTTAC. Their role is to be the facilitators of the program demonstrating a need to 
collect information, and to operate as a point of contact or reference for officers in the 
field needing extra information or guidance. Currently, all tips and leads go directly to 
the Joint Tenorism Task Force (JTTF). The JTTF has a link on most departments’ 
interdepartmental websites and also has the ability to receive information by phone. 

Once the TLO program is stabilized in the law enforcement community, 
the intention of the RTTAC is to extend the program to the other emergency responder 
communities. 118 


118 The overview of the San Diego TLO program is based on the interview with San Diego RTTAC 
commander Lee Yoder, December 10, 2007. 
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e. Overview of the Arizona TLO Program 

The Arizona TLO program is a much more robust and involved program 
than the others that have been described heretofore. There are two levels of TLO in 
Arizona and they receive different levels of training, equipment and support. Level A 
TLOs receive a vehicle, a phone and a laptop computer with secure connectivity 
equipment and are required to dedicate forty hours a month to the program. Level B 
TLOs receive the same equipment but no vehicle. They are required to contribute twenty 
hours a month to the program. 

Both levels of TLO are responders with a mandate to respond to any major 
fire or law incident and perform the intelligence branch function in the Incident 
Command System (ICS). This system has been in operation for three years and it has 
been one of the best marketing tools for the TLO program. Local emergency responders 
are able to regularly see the value of the TLOs as they provide on-scene connectivity and 
intelligence. There were 212 TLOs in Arizona at last count. They are dispersed 
throughout Arizona and respond to major incidents, terrorist or otherwise, and act as a 
liaison to the Arizona Counter Terrorism Information Center. A significant amount of 
their response capability is geared toward incidents or crimes other than terrorism. 
However, they are always observant of any nexus to potential terrorist activity. In 
addition, by making themselves useful, they have created social networks that have 
encouraged information sharing, which will enhance their ability to receive and pass on 
information. Finally, they are delivering an immediate and observable service to the 
emergency responder community within which they operate. 119 


119 The overview of the Arizona TLO program is based on the interview with Norman Beasley. 

86 



2. 


Terrorism Early Warning Groups (TEWG) 


Terrorism early warning groups, as originally conceived in the Los Angeles 
model 120 have, for all practical intents and purposes, been subsumed by the RTTACs or 
the State Terrorism Threat Assessment System. A more basic and perhaps more 
commonly used version of the TEWG, and one that is used by the Sacramento RTTAC, 
is the identification of terrorism early-warning groups as communities of specialized 
knowledge or interest that may be in a position to make observations of potential terrorist 
activity or be the subject of interest from terrorist groups. The Sacramento RTTAC uses 
liaison officers as a conduit between the “group” and the RTTAC. In the case of the 
more traditional ER communities, the liaison officers are referred to as terrorism liaison 
officers (TLOs), which generally liaise with members of their own organization, in either 
law enforcement or fire. However, TLOs are being encouraged to develop TEWGs in 
their geographic area of responsibility with groups that they and their local administrators 
deem appropriate. 

One group, that the Sacramento RTTAC is currently in the process of establishing 
a TEWG and TLOs with, is the public health department, which will be expanded to the 
larger medical community. There are an infinite number of groups that could be created 
as terrorism early-warning groups, such as public works, non-law enforcement 
government agencies, postal workers, schools, agriculture, community organizations, and 
the private sector, particularly those that have vulnerability or may be at risk for a 
potential terrorist attack. 

An additional group that the Sacramento RTTAC is developing as a terrorism 
early warning group collaborates with the FBI's InfraGard 121 program. InfraGard is an 
association of private sector companies that share information regarding threats, 
vulnerabilities and mitigation strategies, which is run by the FBI. Because membership 


120 The Los Angeles terrorism early-warning group has been written about extensively and there are 
numerous excellent sources for further reference. John Sullivan, the acknowledged architect of the TEW 
concept has written any number of articles. 

121 For more information on InfraGard, see their website at http://www.infragard.net/ . 
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in the organization requires a limited background check, members are allowed to receive 
Law Enforcement Sensitive (LES) bulletins. The Los Angeles and the Sacramento 
Infraguard organizations were reported to be robust and beneficial to the respective 
RTTACs. 122 

The Sacramento RTTAC is encouraging all of the TLOs in its thirty-four counties 
to establish TEWGs in their respective jurisdictions. The type and number of TEWGs 
each TLO establishes will be dependent on the threat picture in that jurisdiction, the 
infrastructure that may be at risk, and the availability of groups of interest that may be of 
value in collecting potentially useful intelligence. Each county will be able to assess for 
itself the needs of its particular jurisdiction, as well as its capability to establish 
relationships and act as conduits of information between the TEWG and the RTTAC. 

Once the TEWG is established, separate group lists can be created to disseminate 
relevant information to different groups via e-mail. The bias should be a need to share 
while protecting any necessary confidentiality. The TLO will also have to establish an 
effective reporting mechanism. Members of the TEWG will need to realize some benefit 
for their participation and this will most likely come in the form of information that is 
exchanged between members, the TLO and the RTTAC. This may require the TLO to 
go to the group to give presentations and assist in security assessments, AC AMS, or other 
types of awareness training. 

The LA RTTAC and the NC RTTAC have extensive standing TEWGs within 
their jurisdictions. Some terrorism early-warning groups have their own analytical and 
dissemination systems such as the East Bay terrorism early warning group. A concern 
here is the potential for stove-piping and duplication of efforts. 123 

For fusion centers that are strictly counterterrorism, it is very important to 
establish a TEWG with each of the multiple investigative units in their area of 
responsibility so that they can be apprised of information of interest as it develops. One 


122 Fusion Analyst Training Conference, Monterey, California, January 23, 2008, personal 
communication. 

123 Sena, interview. 
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way for the law enforcement community to gain infonnation from the investigators, or 
from law enforcement in general, is to establish terrorism early-warning groups with 
liaisons from members of each of the significant investigative groups from each of the 
major jurisdictions. For example, the financial crimes unit, or the gang unit, should have 
liaisons with the fusion centers. In this way, if an investigative unit is working a case and 
it seems that there is some potential terrorist nexus, the terrorism early-warning group 
liaison officer should relay that information to the fusion center. This is essentially the 
role of a TLO. Correspondingly, if the fusion center receives infonnation that may be 
tenorism, and initial investigation determines it to be purely criminal, then it should be 
the obligation of the fusion center to relay that information to the appropriate 
investigative unit via the same liaison officer or other method. 

3. Special Considerations for Other ER Communities 

It has been widely held and acknowledged that America’s emergency responders 
have a great capacity for interacting with the public they serve much more intimately than 
their federal counterparts interact. What has been less well understood, until recently, is 
their potential for contribution to the counterterrorism effort. Engaging the emergency 
responder community will take outreach, education and networking. Most of the ER 
disciplines will need the same education as law enforcement on developing a need, 
demonstrating value, providing situational awareness and making reporting accessible. 
As many areas are just getting their law enforcement agencies oriented to providing tips 
and leads, it is understandable that engaging the other disciplines has not been fully 
engaged or, in some cases, even appreciably underway. It will be prudent, though, to 
ensure that steps are taken to include the input from the rest of the ER community. 

Engaging the medically oriented responder disciplines is an area that needs 
further study and attention. The greater medical community consisting of fire, 
Emergency Medical Services (EMS), public health and medical facilities, are not 
normally disposed to reporting suspicious behavior. They are mandatory reporters, by 
law, for certain specified crimes, but it requires the force of law to gain compliance. To 
get the medical community to observe and report on suspicious behavior will be difficult, 
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but it is a worthwhile endeavor. It will require a substantial amount of education to 
convince this community of the need and value of reporting. Even more education will 
be required to make them comfortable with the ethics and legalities of reporting. 

This is even more so with EMS, which does not have mandatory reporting 
requirements and is even prevented from some types of reporting (in California). EMS 
personnel respond to the scene of the incident and are in a position to see not only the 
victim, but the environment that created the injury, often before it has been sanitized. 
The rules for EMS reporting medical information on suspicious incidents are very 
restrictive, even more so than for doctors or other medical personnel. However, EMS can 
report on what Petrie describes as “incident indicators” but can not report medical 
information. There is great value in having EMS report incident indicators but the 
distinction requires education and the legal ramifications will make many, if not most, 
EMS personnel uncomfortable. 124 The ethical considerations will exacerbate the 
reporting reluctance as well as the disinclination of many of the helping professions to 
“intrude” in a patient’s privacy. With that said, the potential for useful information 
makes the effort worthwhile and justifies the reporting attempts. 

4. Community-Oriented Policing 

One commonly agreed method of prevention is the need for intelligence. 
Intelligence is a derivative of information, and one of the best sources of in formation for 
domestic counterintelligence is, arguably, Human Intelligence (HUMINT). A potential 
source of human intelligence is Community Oriented Policing (COP); however, this has 
proven to be an under-utilized tool. To support this, the survey data reported that 60 
percent of the fusion centers stated that they received less than 5 percent of tips and leads 
from COP efforts, with an additional 20 percent stating they received 5 to 10 percent of 


124 Michael Petrie, “The Use of EMS Personnel as Intelligence Sensors: Critical Issues and 
Recommended Practices,” Homeland Security Affairs III, no. 3 (September 2007), 
http://www.hsaj.org/7articleAI.3.6 , Last accessed February 11, 2008. This is a very brief comment on 
Petrie’s article. I would strongly recommend anyone developing an EMS TLO or similar reporting 
program to read Petrie’s article the Use of EMS Personnel as Intelligence Sensors: Critical Issues and 
Recommended Practices. It is informative, well written and a thorough treatment of this important and 
complex subject. 
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their tips or leads from COP. Seventy-five percent of the reporting fusion centers stated 
that COP was an under-utilized information source. How do we trade on the community 
capital of goodwill created by COP and how do we make that work in the collection of 
information useful to counterterrorist action? 

The Sacramento Urban Area, and indeed the nation as a whole, has made little 
attempt to engage the Muslim community in targeted COP programs. There are 
exceptions, such as Southeastern Michigan, Boston and Southern California, 125 but as a 
whole the law enforcement community has relied on COP in general to engage the 
Muslim community. In defense of law enforcement, limited outreach to the Muslim 
community is a consequence, in part due to the fact that the Muslim community, in much 
of the country, does not reside in ethnic enclaves as they do in Europe. Muslims are 
connected by a religion and often by an ethnicity, but are dispersed throughout our 
community, and as such, have been difficult to engage with the COP program. 

This is due to the consistent and common theme throughout almost all of the 
literature and practice regarding COP: the interpretation of community as having a 
definite geographic orientation or boundary. COP in the United States is almost 
exclusively geographic-centric within well-defined and tightly controlled boundaries 
determined by jurisdictional, environmental, and economic or social groupings. 

Given the geographic dispersal of the majority of the Muslim community, an 
effective COP program must make a paradigm shift from a geographic-centric orientation 
to an ideological-centric orientation. Daniel Flynn, in a white paper for the Police 
Executive Research Forum, discusses the concept of community and non-traditional 
communities in depth. His paper accurately describes the need to be flexible in 
identifying a community so as to be able to include groups that share a common character 
or identity with a common concern or problem. Flynn describes a nontraditional 
community as: 

125 Deborah Ramirez, Sasha C. O’Connell, and Rabia Zafar, “Developing Partnerships between Law 
Enforcement and American Muslim Arab and Sikh Communities A Promising Practices Guide, The 
Partnering for Prevention and Community Safety Initiative,” Northeastern University, 2004, 
http://sps.neu.edu . Last accessed September 20, 2007. This report discusses, in some depth, community 
outreach practices to the Muslim, Arab and Sikh communities. 
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The non-traditional community is more than a special interest group or 
group formed around one issue. The non-traditional community is 
systemic and consists of a collection or set of groups that share the 
characteristics of the community. It is not restricted to being residential or 
residential/business and it need not be located in areas beset with deep- 
seated chronic high crime rates. 126 

Therefore, a COP program with the aim of ameliorating alienation and 
disaffection for the Muslim community from the larger community as a whole, and 
developing contacts that could potentially lead to useful information, will require a new 
conceptualization of “community.” This is a rather radical departure from the common 
and current practice and there will be many challenges. However, there is a great need to 
reach out to the Muslim community, which has its religion and culture inextricably 
woven together. A re-assessment of community and a fresh set of strategies will help us 
gain a connection with the Muslim community. It is critical that the primary motivation 
is to recognize them as valued members of our community and ease the feelings of 
alienation and the sense of being disconnected from the larger community. 

The creation, development and implementation of such a program will be a 
significant undertaking. The desire to immediately try to turn members of the Muslim 
community into informants may be tempting, but should be avoided. Information 
exchanges of that kind requires trust and mutually beneficial relationships (either 
financial or common cause), particularly when the consequences of providing 
information could be costly to yourself and your family. 

When a COP program is rolled out to the community, we need to make sure that 
we are providing an environment that creates relationships with the Muslim community 
that are seen as altruistic and mutually beneficial. Some potential areas to explore would 
include: 1) a Muslim citizens’ academy; 2) political action groups of some type that 
would have a community voice and access to administrators and the law enforcement 
community, as well as local government; 3) the development of youth programs and 
activities that do not isolate Muslim youth but engage them with other members of the 

126 Daniel W. Flynn, Defining the Community in Community Policing, Police Executive Research 
Forum, 1998, 8. 
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community; 4) using the media to recognize positive Muslim events or citizen activities; 
5) establish educational forums for the public and law enforcement about the Muslim 
community in an attempt to try to establish understanding and positive community 
relations; and, 6) in recognition of the Muslim culture’s religious requirement to 
contribute to charity, a committee could be established to identify charities that have no 
demonstrable links to terrorism. 

Once we have created contacts and relationships built on mutually beneficial 
activities, the bonds of trust necessary to engage in information sharing will have been 
established. Potentially useful information will flow, in time, with confidence and trust. 
If the intelligence collection process is started too soon, our efforts will be seen as thinly 
disguised self-serving opportunities and will not be well received. 
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V. RECOMMENDATIONS FOR FUSION CENTER OPERATION 


Prevention is the first goal in the National Strategy for Homeland Security. It can 
be argued that fusion centers provide an excellent opportunity to for that prevention. For 
fusion centers to be effective, it will be necessary for elected officials, emergency 
responders, administrators, and the rank and file emergency responder community to 
know the value that fusion centers provide. There are many secrets in fusion centers; the 
value of the fusion center must not be kept secret. The following are recommendations 
based on the findings of this thesis, grouped by fusion center functions: 

A. MANAGEMENT 

1. Mission 

The management of the fusion center should not be left to develop in a haphazard 
manner with little forethought as to an ultimate strategic plan to achieve the goal of how 
best to detect or deter a terrorist attack. This was perhaps acceptable in the immediate 
aftermath of 9/11. However, with time for reflection and thought, it is important to assess 
the role, function, and responsibilities of fusion centers and to determine how they are 
managed and what they should produce. Fusion centers will require guidance to 
accomplish that objective. 

One of the first steps should be the development of a governance board. The 
board should have a cross representation of federal, state and local members, as well as 
representation from different emergency responder disciplines. Suggested representation 
should include FBI and U.S. Attorneys’ Offices, lead law enforcement executives in the 
region, and at least one non-law enforcement executive from the emergency responder 
community. This governance board would ensure a regional approach, collaboration and 
network with all partners (rather than a parochial orientation directed at one particular 
agency’s priorities), create a network of interdependent jurisdictions and disciplines with 
a common and acceptable tasking requirement for the fusion center. The centers are 
essentially law enforcement organizations, but they serve a greater mission that 
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incorporates the sphere of all the emergency responders and their input will 
prove valuable, enhancing the intelligence product. 

The board should adopt a written memorandum of understanding or similar 
agreement with a written mission statement. This thesis reaffirms the recommendations 
found in the FCG guideline three regarding the above recommendations for a governance 
board; however, it is also recommended that further steps be taken. One of the most 
important actions the board should take — in addition to determining who the customers 
of the fusion center are — is to determine the degree of support each customer should be 
allocated. The common customers of a fusion center are tactical investigative case 
support (generally for the FBI Joint Terrorism Task Force); criminal case support for 
major criminal enterprises; general situational awareness for emergency responders; and, 
strategic situational awareness reports on regional threat assessments for policy makers. 
The range of support for these different customers’ groups is huge, with some working 
almost exclusively strategic support and some working almost exclusively in support of 
the JTTF. There is not a right or wrong to any of these approaches, but they should be 
based on an identified need, supported by a regional threat picture, and authorized by the 
direction of an involved governance board, reinforced by the mission statement. The 
scope of work should not be directed simply by “it’s what we’ve always done.” 

In order to accomplish these goals, the board must have an accurate situational 
awareness of the threat picture in their area of operation, as well as any particular 
vulnerability that their region may possess. This will require high-level briefings by 
qualified personnel. 

The board should agree to meet on a regular basis to keep informed and maintain 
connection with the fusion center and other board members. The board should also 
recognize that fusion centers are a relatively new phenomenon for domestic law 
enforcement, keeping in mind the need to be flexible and responsive to changes. Finally, 
the board needs to ensure that the fusion center is familiar with the mission and is, in fact, 
adhering to that mission. 
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Agency heads of law enforcement and fire departments should obtain secret 
clearances, available through the Department of Homeland Security, so that they may be 
briefed properly and gain confidence that everything that can or should be shared is being 
shared. 


2. Philosophy 

The threat of a terrorist attack has dramatically shifted the focus of local law 
enforcement. The investigation of terrorism, and the collection and analysis of 
intelligence to aid in prevention, is a new role for domestic law enforcement; this 
newness is a major sticking point as to how best to accomplish this obvious but elusive 
goal. 


3. Prevention 

It can be argued that prevention may well be the best way to protect one’s 
community. In the immediate aftermath of 9/11, the vast majority of resources were 
dedicated to strengthening our response capabilities. Prevention as an active goal is a 
relatively new philosophical position. The benefits of prevention can be demonstrated by 
illustrating the values of strategic situational awareness for policymakers, tactical case 
support for counterterrorist efforts, and criminal case support for major crimes that 
present a real and visible threat to local communities. It is a recommendation of this 
thesis that educating administrators on the value and benefits of prevention become a 
specific goal; this is a recommendation that is missing from the FCG. 

As part of prevention, a risk management policy needs to be adopted. While this 
thesis cannot recommend what is the best risk management policy, it is recommended 
that the issue be addressed, debated and resolved. The issue is: what is an acceptable 
level of risk within one’s community and how does one most effectively and efficiently 
buy down that risk with the dollars allocated to prevention? The answer to that question 
is your risk management policy. What must be considered is not only your community’s 
tolerance for risk, but what risks are considered. Will your risk management policy focus 
exclusively on the prevention and response to the remote threat of a WMD or will you 
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address the more likely conventional terrorist attack of an improvised explosive device, a 
vehicle borne improvised explosive device, or a firearm. 

Whatever prevention model and risk management positions are taken, they need 
to be predicated on the threat picture that the fusion center is operating under. 
Recognizing the local threat picture, keeping aware of the emergent tends as well as 
investigating and interdicting these threats whenever possible, is a job where the fusion 
center can make a significant contribution. These threats will necessarily include jihadist 
ideologies, both the transnational and, more likely, the locally generated homegrown 
jihadist, but will also include other domestic concerns such as radicalized prisoners, 
environmental terrorists, right-wing terrorists and other single-issue groups. 

4. Tactical vs. Strategic 

It is the recommendation of this thesis that the next iteration of the Fusion Center 
Guidelines addresses and agrees upon the definitions and roles of strategic analyst, 
strategic analysis, tactical analyst, tactical analysis, criminal analyst and criminal 
analysis, as there is no current distinction between what is tactical and what strategic. 
The FCG have a heavy bias toward the tactical, which is not surprising, as the majority of 
the work in state and local fusion centers is currently being done at the tactical level. 
However, there is a need for strategic analysis and it should be clearly identified as to 
what it is and who might be the potential customer. 

The staff of the fusion center should reflect the mission and customer support 
allocations established by the governance board and the director of the fusion center. As 
it stands, the majority of fusion centers provide more tactical mission support than 
strategic assessments (tactical as in case support through research, database searches, and 
link analysis activities, not field operations). Most centers would likely get by with one 
or two strategic analysts, and as they are much more difficult and expensive to engage 
and retain, a fusion center should not try to over-staff with expensive personnel that will 
not be utilized properly. The majority of the analytic support staff ought to be geared 
toward the greater workload, tactical case support. If a center starts to make more use of 
strategic analysis, then the staffing should be adjusted accordingly. 
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The information revealed in this thesis indicates that the overwhelming majority 
of fusion centers should have some type of all-crime perspective. It should go without 
saying that any active counterterrorism investigative support should always have a 
primary role in the fusion center. Most fusion centers already incorporate some type of 
all-crime posture in their fusion centers. 

Elected officials and administrators should also be encouraged to use the tasking 
capability to have strategic products prepared that are of concern to local officials. This 
level of customer service and interaction will not only help educate administrators as to 
the usefulness of the fusion center, but also establish contacts and the beginnings of a 
network. This increased interaction could lead to increased support and funding. 

5. Prioritization 

There should be some system or process, either from the governance board or the 
director, that identifies the prioritization of work to be done. This can be accomplished in 
the crafting of the standing requirements for the fusion center. There should also be 
prioritization for case assignment for incoming tips. Not all tips are alike and they should 
not be treated as such. Some form of metrics should be established to detennine the 
extent of investigation accorded each tip or lead; otherwise, we may well find ourselves 
doing exhaustive investigations on tips that are months old while neglecting more 
promising leads on current tips. This concept is generally refereed to in FCG guideline 
two, but should be called out more specifically in future iterations. 

6. Leadership 

To carry out the mission of the fusion center, the governance board should 
designate a director who will be responsible and accountable for the operation of the 
fusion center. The FCG guideline number three states that the governance board should 
define a management structure to include what entity will oversee the center’s operations 
and daily activities. There is no recommendation on how that should be accomplished; 
however, consideration should be given to the need for a director to have a wide range of 
experience in intelligence, law enforcement and the fusion process. More importantly, 
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the director should have the ability to establish and maintain networks, provide leadership 
in the fusion center, guide intelligence production, and maintain the standards that are 
critical to continued and effective intelligence operations. Without the appropriate 
guidance and leadership, the fusion centers risk misdirection and misapplication of their 
mission and focus, and could end up producing intelligence products that are irrelevant or 
inapplicable to their environment. The management style and networking abilities of a 
director will be at least as important as technical knowledge, which needs to be 
recognized. 

In the emergent and evolving world of counterterrorism, autocratic and hierarchal 
management styles will be not only ineffective but counter-productive. To operate 
effectively, the centers will need to be able to operate in a network, sharing information 
and situational information with various levels of government, jurisdictions, and 
disciplines, which will not be answerable to each other, requiring a cooperative 
networked approach to management. It will take a skillful communicator with a 
recognized degree of credibility and competence to garner the trust necessary to interact 
with these divergent groups. 

There will be some difficulties, especially in locales where there are competing 
law enforcement jurisdictions vying for control, in deciding who the director will be and 
from what agency. It will be up to the board to find a person acceptable to all and up to 
the director to show impartiality in the administration of his or her office. 

B. ANALYSTS 

Fusion center managers need to make the distinction between strategic analysts 
and tactical analysts. The strategic analysts are generally persons with graduate degrees 
and years of experience, able to make predictive assessments from a broad range of 
domain expertise. Tactical analysts conduct post-event research and assist with case- 
support functions. Both are valuable and necessary skills sets but serve very different 
missions. The center needs to staff appropriately so that each category of analyst is 
performing the function it is trained and qualified to conduct. 
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Strategic analysts will almost certainly be civilian employees. Tactical analysts 
can be civilian or they can be law enforcement officers, and occasionally from other ER 
disciplines. However, it takes training and the correct aptitude to be a tactical analyst; it 
is not a plug-and-play operation at which all law enforcement personnel will be adept. 
Additionally, sworn officer analysts will rotate for career development or promotions. A 
high analyst turnover will almost guarantee a constant state of training and diminished 
capacity as staff will not only have to be trained in job functions, but wait for top secret 
clearances before they can work on any significant projects. The turnover will also affect 
historical continuity. For these reasons, a fusion center should have a high percentage of 
its analyst staff as career civilian employees. Requiring and enforcing a minimum term, 
as recommended by the NCISP, is another good idea to maintain a qualified analytical 
pool. 

It is noteworthy to observe, however, that the training that most analysts have 
received has been from professional organizations dedicated to the profession of law 
enforcement criminal intelligence. It is also noteworthy to observe that the Fusion Center 
Guidelines are based on the criminal intelligence process. It is therefore not surprising 
when the CRS report notes that most fusion centers are not operating as true intelligence 
fusion centers 127 but as criminal analyst centers. It may well be the case that this is so 
because the greater need is for tactical analysis versus strategic analysis in the state and 
local fusion centers. 

C. DISSEMINATION 

In order to facilitate the dissemination of information on as wide a distribution 
level as possible, the fusion center needs to write their proprietary product at a “for 
official use only” (FOUO) tear line. This will ensure the widest possible distribution to 
the greatest number of emergency responder disciplines as well as individual responders. 
Wherever possible, the fusion center should avoid writing product that is classified as 
secret or higher. The classification "law enforcement sensitive" (LES) should be used 
very judiciously, and should have written protocols to use as guidelines to prevent routine 


127 Masse et al., CRS report for Congress, Summary. 
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use of LES. The classification distinction between “for official use only” and “law 
enforcement sensitive” is, in many respects, one of semantics. However, what it does is 
restrict the access of infonnation to fire personnel and all the other emergency responder 
disciplines. This classification should be avoided unless there is information that would 
compromise a criminal investigation, in which case distribution would be severely 
limited at whatever classification. The law enforcement sensitive classification restricts 
potential distribution and the resultant potential return of information and creates a 
contentious relationship with our partners. The center should also encourage originators 
of products received to avoid LES where possible; this is an issue not addressed by the 
FCG. 

To continue and expand the flow of information, the fusion center needs to 
acknowledge the individual emergency responder when he or she provides a tip or lead. 
It is imperative to acknowledge this information whether or not it is ultimately proven to 
be useful. In fact, the center should not wait until it determines the value of the tip before 
the contribution is acknowledged. This acknowledgment should be automatic upon 
information being provided and the tipster should receive a reply from the fusion center 
with some generic information as to the outcome of the tip. It can be as innocuous as: 
this infonnation supports an ongoing investigation, this information is filed at this time, 
or this information is being reviewed. 

The center does not need to reveal sources or methods to acknowledge those that 
are assisting by providing information. An effort on the part of the fusion center to 
involve and acknowledge the emergency responder community will greatly enhance the 
participation of that group in the collection of raw data to be analyzed. 

The most common and effective means of distributing information bulletins to the 
emergency responder community seems to be e-mail. All jurisdictions should make 
every effort to insure that their personnel have access to e-mail. 

The FCGs identify the need for dissemination in both the intelligence process and 
the fusion process but the issue of consumption is not addressed. Production of 
intelligence product needs to take into consideration who the end user will be for what 
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product, and what will be the best form to convey that information to maximize 
assimilation. Another issue not addressed by the FCGs is the need for the end user of 
each category of product to provide feedback to the analysts and the fusion center 
management. 

D. SUMMARY OF FUSION CENTER RECOMMENDATIONS 

• Governance board should determine who the customers are 

• Governance board should direct, with fusion center manager input, the 
level of support for each customer, i.e. tactical case support vs. strategic 
situational awareness 

• Identify the workload for strategic vs. tactical analysts 

• Educate local ER administrators on the value of prevention 

• Provide situational awareness to ER administrators so that an objective 
risk management policy can be adopted 

• The next iteration of the Fusion Center Guidelines should define and 
develop specific roles for strategic analyst, tactical analyst and crime 
analyst 

• In the interim fusion centers should define the duties and role of strategic, 
tactical and crime analysts within their own organizations 

• Provide analyst training relevant to their role and future development 

• Maintain a high percentage of civilian analysts 

• Provide sufficient situational awareness to the ER community so that they 
will recognize and report terrorist pre incident indicators when they are 
observed 

• Provide and advertise tip and lead reporting mechanisms that are available 
and user friendly 
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• Provide an all crimes perspective, while recognizing the counter terrorism 
mission is primary 

• Encourage ER administrators to use their tasking capability to have 
strategic products prepared that are of concern to local officials 

• An objective system of prioritization should be established to determine 
the extent of investigation accorded each tip or lead 

• Each fusion center should have a director; the management style and 
networking abilities of a director will be at least as important as technical 
knowledge 

• Write and disseminate intelligence product, to the extent possible, at “for 
official use only” (FOUO) 

• The classification "law enforcement sensitive" (LES) should be used very 
judiciously, and should have written protocols 

• The Fusion Center Guidelines should include the issue of intelligence 
consumption when discussing dissemination 

• The Fusion Center Guidelines should include end user feedback for all 
intelligence products in the next iteration 
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VI. RECOMMENDATION FOR DATA COLLECTION 


As often repeated throughout this thesis, if fusion centers are to become valuable 
to local elected officials, emergency responder administrators, and emergency responder 
line-personnel, they must produce timely, relevant and locally actionable intelligence 
product. To produce locally actionable intelligence, the fusion center will have to not 
only analyze data from a variety of classified databases and a huge glut of open source 
data, but also integrate information collected locally from the regional emergency 
responders to synthesize a final product. 

A. TERRORISM LIAISON OFFICERS 

One of the best ways to gather this intelligence is with the creation and 
development of a robust terrorism liaison officer (TLO) program. These programs most 
generally start with law enforcement and move into the other emergency responder 
disciplines addressing the unique issues of each discipline in turn. Prior to initiating a 
TLO program, those responsible for implementing it should contact the ER 
administrators in the region explaining the program benefits and the amount of resources 
those administrators can be expected to contribute; this is normally a nominal amount of 
resources. 

Once administrators have agreed to commit to the program, they should 
recommend which officers to nominate as TLOs, particularly the TLO coordinator, 
should a coordinator be designated for that agency. The TLOs must have access to the 
management of their individual organizations as well as credibility with and access to the 
rank-and-file of their respective organizations. TLOs should receive training in basic 
situational awareness of terrorist methods of operation and pre-incident indicators. TLOs 
should also receive training on how to facilitate the TLO program back in their 
jurisdiction. 

The roles and responsibilities for TLOs must be established and clearly articulated 
so that people understand what their jobs are, and equally important, what they are not. 
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Most TLO programs have established the role of the TLO to be a point of reference and a 
contact for his or her fellow officers or firefighters. Some, as in the case of Arizona, are 
responders, which is a much more expensive proposition. Whichever route is taken, the 
role of the TLO must be very clear in the mind of the TLOs themselves, their 
administrators and the rank-and-file. 

Once the law enforcement TLO program has been stood up, the fusion center 
should turn their attention to developing TLO programs within the other emergency 
responder disciplines. As with the law enforcement TLOs, it will be important to develop 
a need to report observations as well as establish a value to reporting such information. 
This will be even more so in the other emergency responder disciplines as they are not 
naturally geared toward investigation, observation and reporting of behavior. This will 
be particularly true for the medical professions who are confronted with issues of 
patients’ privacy. The infonnation that these responders can provide could be very 
valuable, and certainly will be worth the effort to educate all involved in the process of 
legally and ethically providing this information to the fusion centers. However, great 
care must be taken to ensure that all laws are followed and that the ERs are educated to a 
level that makes them comfortable with reporting information that is pennissible. 

B. TERRORISM EARLY WARNING GROUP (TEWG) 

The establishment of terrorism early warning groups is an excellent way for the 
fusion centers to gain infonnation on sector-specific infonnation or infonnation derived 
from particular areas of concern. Examples include the agriculture industry, chemical 
industry, transportation, and school administrators. The TLOs, in conjunction with the 
fusion center and local ER administrators, should identify which tenorism early-warning 
groups would be beneficial to their individual regions, and together, should identify a list 
of who should or could be involved in this activity. 

These groups will require some form of quid pro quo; generally, useful 
information will be sufficient currency for their involvement. There are many ways to 
start these programs; most often, the easiest is to start with existing groups or 
organizations. Often there are industry associations that meet on a regular basis. In 
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addition, emergency response planning meetings are often used as a catalyst to initiate a 
TEWG. One useful program that has been successful in some jurisdictions is the FBI’s 
InfraGard program. Once these programs or TEWGs are established, however, they 
cannot be abandoned. It will take a concerted effort and regular interaction to maintain 
the relationships that will promote the useful exchange of information. Administrators 
also need to be mindful of the possibility of TLOs becoming over-extended and unable to 
make all the requested commitments. Most TLOs take on the job as an “other duty as 
assigned,” and not a full-time job. 

In the event an agency chooses a purely terrorist orientation for the fusion center, 
as opposed to an all-crimes approach, it would be valuable for those agencies to establish 
a TEWG with the criminal investigative units of the region’s law enforcement agencies. 

C. COMMUNITY-ORIENTED POLICING 

One final method of data collection for the emergency responder community is 
community oriented policing (COP). This approach would be by far the most labor- 
intensive of those discussed. The benefit potential is significant and the concept deserves 
some attention. A properly developed COP program can engage local Muslim 
communities to enhance their sense of belonging and comfort and, at the same time, 
minimize any feelings of alienation, mistrust or disaffection. A second benefit — one 
that will come in due course if the program is established with honest intentions and not a 
thinly veiled attempt to create immediate informants — is the establishment of 
relationships and trust. Once these are ingrained, the increased confidence level in the 
“system” may lead to increased reporting of suspicious behaviors that members of the 
Muslim community may become aware of or actually witness. 

As many in the Muslim community do not live in tight geographic confines, as is 
often the case in Europe, a successful COP program would have to interpret community 
as larger or different from the common geographic consideration. Community will have 
to be perceived in more of an ideological context rather than a neighborhood concern. 
Acting now, to build positive relationships by involving and engaging the Muslim 
community, will not only provide a rich and useful source of future infonnation, it will, 


107 



more importantly, have the capability of preventing future attacks by removing potential 
terrorists from the ranks of recruits for radicalized jihadist ideology. This relationship 
must be based on fair, reasonable and reciprocal relationships that are respectful of each 
other’s rights, needs and objectives. 

D. SUMMARY OF DATA COLLECTION RECOMMENDATIONS 

• Each fusion center should develop a TLO program in their area of 
responsibility 

• Local administrators should be engaged and educated for support 

• Local administrators need to select their TLOs 

• The fusion centers should provide/facilitate training for the TLOs 

• TLOs need to be trained on the organizational and administrative 
responsibilities of their role 

• The fusion center should provide regular intelligence products to the TLOs 

• The fusion centers ought to provide a support network to sustain the TLOs 

• TLOs are encouraged to develop TEWGs as they are able and as need 
exists 

• Local agencies should assist in maintaining a cadre of trained TLOs to 
respond to staff turnover issues 

• A COP program in the Muslim community should consider community as 
a non geographic concept and define it more ideologically 
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VII. CONCLUSION 


No one can know what our threat potential is in the current environment. As a 
country and as local public servants, we need to be prepared without over-reacting, 
protect both our citizens and our rights, and be proactive in providing intelligence to deter 
and mitigate, within a reasonable budget with reasonable risks. Fusion centers have the 
capability of assisting in these efforts. They also have the capability to fail. It is the 
responsibility of those in fusion center governance and management positions to ensure 
that fusion centers succeed. Success can and should be defined locally; the criterion for 
success needs to be clearly articulated. 

This thesis started by asking the questions: What is the mission of the state and 
local fusion centers? Do they have a national value? Do they have a local value? I 
believe the evidence presented herein has demonstrated that state and local fusion centers 
do indeed have a real mission in the protection of our homeland, and in the process can 
contribute both a national and a local value. To do this, however, fusion centers will 
have to respond the second research question: What can be done to improve the 
effectiveness of state and local fusion centers? 

Fusion centers can accomplish this by identifying their mission and their 
customers, at what level of analytic product they will produce, and to whom. Not all 
fusion centers will need the same amount of strategic analysis or tactical analysis, but, in 
order to determine what to produce, they will have to understand their customers’ needs 
and ensure they are educated so they understand the difference between the two products. 
Fusion centers will also need to determine how they will integrate the emergency 
responder community. A TLO program is one method that shows promise and is easily 
adaptable. 

It is the responsibility of those in fusion center governance positions and 
management positions to ensure that fusion centers succeed. If the fusion centers can 
produce a timely, locally actionable and relevant product to its customers — in the form 
of strategic analysis to policy makers; tactical analysis to counter terrorism; tactical 
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analysis to major criminal investigations; and, situational awareness and reporting 
mechanisms to the emergency responder community — they will have established their 
value. 

By implementing the key recommendations of this thesis, fusion centers will 
progress into becoming significant assets in our counterterrorism fight. If fusion centers 
fail to prove their relevance and local worth, they face the danger of losing support, not 
only from federal funding sources, but also from local agencies, which sponsor a great 
deal of the state and local fusion center resources. 

This thesis has also left many unanswered questions that future efforts could 
research. Some issues for future researchers to consider are: 

• Do these results reflect trends in other fusion centers or are they specific to 
California? 

• The development of a uniform definition and role for strategic, tactical and 
criminal analysts. 

• The development of a process for consumer intelligence requirements and 
product delivery. 

• The role and impact of leadership on fusion centers. 

• The impact of information sharing at multi-government levels. 

• Further research on TLO programs and their effectiveness. 

• The use of community-oriented policing as a counterterrorism tool (or its 
lack of effective use). 

• The issue of situational awareness of terrorist threat in the emergency 
responder community. 

• What parameters or influences guide the level of strategic analysis that is 
needed at the state and local level? 
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APPENDIX 


Emergency responder information collection 

1. Fusion Center Survey 


The purpose of this survey Is to elicit Information from fusion centers about their method of operation, organization 
and goals. The survey Is also trying to determine the type and amount of data sources employed and how the end 
product is used and by whom. It also attempts to identify common Issues and needs from the perspective of those 
operating/managing fusion centers. The survey should take about 15 minutes to fill out and should be filled out by a 
director or manager of the fusion center. Thank you for your time. 

The Individual responses will remain confidential unless you Indicate otherwise at the end of the survey. 


Glossary 

Line- first line personnel, i.e. fire fighter, police officer 
Unit- organization that comprises the referenced group 
ER- Emergency Responder 
TLO- Terrorism Liaison Officer 

Maturity- level of operational readiness of a fusion center, (i.e. a mature fusion center has a trained staff with 
clearances and access to classified data bases). 

Task-Ability to assign work, analysis or a data request 
Training-standardized training from a recognized analyst training institution 

1. Is your unit: 

A fusion center 

An intelligence unit 

Regional collaboration 

Single entity, i.e. police intelligence unit 

If you are other than a single entity unit who are your partners? 


2. Is your unit: 


Federally funded 
State funded 
Locally funded 
Combination 
Other (please specify) 


3. How much of your fusion center is grant funded? 



less than 10% 

10-25% 

26-50% 

51-75% 

76-100% 

State 

o 

o 

o 

o 

o 

Federal 

o 

o 

o 

o 

o 

Other 

o 

o 

o 

o 

o 
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Emergency responder information collection 


4. How would you rate the current maturity of your unit? 

Operational status 


We are at the 
concept/proposal stage 
Our current staffing level 
is 

Percentage of our staff 
with Top Secret clearance 

Percentage of our staff 
that has access to 
classified data bases 

Percentage of staff 
trained and cleared to 
operate secure data 
bases 

Percentage of staff 
trained in intelligence 
analysis 

Other (please specify) 


5. What is the status of your training? 

What analysis training 
does your staff receive? 

What analysis training 
would you like to see 
available for your staff? 

6. Is your unit's primary function tactical (case support) or strategic (policy/threat 
assessment)? 


d 

Zl 


7. Who is the primary consumer of your product? 



Never 

Seldom 

Sometimes 

Often 

Most of the 

time 

Almost always 

Always 

Investigators 

o 

o 

o 

o 

o 

0 

o 

Policy Makers 

o 

o 

o 

o 

o 

o 

o 

Law Enforcement 

o 

o 

o 

o 

o 

o 

o 

Elected Officials 

o 

o 

o 

o 

o 

o 

o 

Non Law enforcement 
emergency responders 

o 

o 

o 

o 

o 

o 

o 

Other O O 

If product is for investigators, what is the crime category? 

o 

o 

o 

0 

o 
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Emergency responder information collection 


8. What amount of your source data for analysis comes from: 



Less than 10% 

10-25% 

25-50% 

50-75% 

75-100% 

Federal government, i.e. 
FBI 

□ 

□ 

□ 

□ 

□ 

State government 

□ 

□ 

□ 

□ 

□ 

Local agencies 

□ 

□ 

□ 

□ 

□ 

Open source 

□ 

□ 

□ 

□ 

□ 

Private Sector 

□ 

□ 

□ 

□ 

□ 

Other 

□ 

□ 

□ 

□ 

□ 

9. Of your local agencies data sources what amount, if any. 

comes from: 



Less than 10% 

10-25% 

25-50% 

50-75% 

75-100% 

Law Enforcement 

□ 

□ 

□ 

□ 

□ 

Terrorism Liaison Officer 

(TLO) 

□ 

□ 

□ 

□ 

□ 

Fire 

□ 

□ 

□ 

□ 

□ 

Public Health 

□ 

□ 

□ 

□ 

□ 

Emergency Medical 

Services 

□ 

□ 

□ 

□ 

□ 

Public Works 

□ 

□ 

□ 

□ 

□ 

Other 

□ 

□ 

□ 

□ 

□ 

Other (please specify) 












10. Of all the data sources you employ for intelligence data collection and analysis 

how much of the data comes from: 





Less than 10% 

10-25% 

25-50% 

50-75% 

75-100% 

Open sources (i.e. 
media/internet) 

□ 

□ 

□ 

□ 

□ 

For Official Use Only (i.e., 
regional law 
enforcement) 

□ 

□ 

□ 

□ 

□ 

Secret (i.e., classified 
government source) 

□ 

□ 

□ 

□ 

□ 

Top Secret 

□ 

□ 

□ 

□ 

□ 

11. What percentage of the work produced in your unit is disseminated at the: 


Less than 10% 

10-25% 

25-50% 

50-75% 

75-100% 

Unclassified level 

□ 

□ 

□ 

□ 

□ 

For Official Use Only 

□ 

□ 

□ 

□ 

□ 

Law Enforcement 

Sensitive 

□ 

□ 

□ 

□ 

□ 

Secret 

□ 

□ 

□ 

□ 

□ 

Top Secret 

□ 

□ 

□ 

□ 

□ 
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Emergency responder information collection 


12. How is your intelligence product disseminated at the different classification 
levels? 

Dissemination method 

For Official Use Only | [ ▼ | 

Law Enforcement I |V| 

Sensitive 

Secret [ |^| 

Top Secret | | ▼ | 

Unclassified | [ ▼ | 

Other (please specify) 


13. What method does your unit use to disseminate information/intelligence to the 
line level emergency responder (ER) community. 

Unit has an internal method to disseminate to line level ERs 
Unit relies on liaisons to ER community to disseminate info 
Unit disseminates to investigative units only 
Other (please specify) 


14. Do you think that, as a source, the line level Emergency Responder community 
has: 



Never 

Seldom 

Sometimes 

Often 

Usually 

Almost 

always 

Always 

N/A 

Access to potentially 
valuable information? 

o 

o 

o 

o 

o 

o 

o 

o 

Is sufficiently aware of 
what to look for? 

o 

o 

o 

o 

o 

o 

o 

o 

Has appropriate reporting 

mechanisms 

o 

o 

o 

o 

o 

o 

o 

o 

Is aware of reporting 
mechanisms 

o 

o 

o 

o 

o 

o 

o 

o 

Mechanisms are avaliable 

o 

o 

o 

o 

o 

o 

o 

o 

Mechanisms user friendly 

o 

o 

o 

o 

o 

o 

o 

o 

Is taking full advantage 
of reporting opportunities 

o 

o 

o 

o 

o 

o 

o 

o 


15. Do you feel that the ER community is being appropriately utilized by your unit as 
a data source? 
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Emergency responder information collection 


16. Community Oriented Policing is often cited as a source of potential information 
for law enforcement in the Homeland Security effort. 

None Less than 5% 5-10% 10-25% 25-50% Over 50% 

Community Oriented 
Policing provides the 
following amount of our 
tips and leads. 

17. Is Community Oriented Policing under utilized as an information source? 

8 ; 


I Yes 
I NO 


If yes, how can that be improved? 


18. Do you feel it is important to acknowledge members of the ER community that 
provide information, a tip or a lead. 


Does your unit acknowledge those 
that provide information? 


Does your unit 
acknowledge emergency 
responders that provide 
information? 


If yes, how? 

i—a 


If yes, how? 

I-B 


19. Can you, or your analysts, "task" the ER community with a request for additional 
information on case being worked? 


0 


Yes 

No 


If yes, how? 

I 


20. Does your unit have a liaison officer with (check all that apply): 

Y/N? Role Role Role 


Law Enforcement 
Fire 

Emergency Medical 
Services 

Public Health 

Public Works 

Other 

Other (please specify) 


r~ 


i 

▼ | 

i 

▼ 1 


1 _Id 

r~ 

▼ i 

i 

~i-i 


21. If you have a Terrorism Liaison Officer (or similar) program what are the 
beneifts? 
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Emergency responder information collection 


22. If you have a Terrorism Liaison Officer (or similar) program, how would you 
improve it if you were able to make the changes? 

zi 

23. Is your unit only concerned with terrorist activity? 

P Yes 
□ No 


24. If your unit produces analysis on crimes other than terrorist threats: 


Narcotics 

Money 

Laundering 

Counterfeiting 
(other than 
money) 

Financial 

Crimes 

Crimes of 

Violences 

Gangs 

Other 

What crimes are analyzed? j 

□ 

□ 

□ 

□ 

□ 

□ 


Other (please specify) 

25. If your unit conducts "other than terrorist analysis" how is the decision made on 
what gets analyzed? 

Policy 

Unit director/commander 

Immediate supervisor 

Investigator 

Analyst 

Other 

Other (please specify) 

26. Who can "task” your unit and how? 

I 1 


27. If you are currently a terrorist and "other crimes" analysis unit, how would it 
affect your unit if it were required to focus exclusively on anti-terrorist activity? 



Never 

Seldom 

Sometimes 

Often 

Usually 

Almost always 

Always 

Useable intelligence 
product would be reduced 

o 

o 

o 

o 

o 

o 

o 

"Value" to consumer/end 
users would be reduced 

o 

o 

o 

o 

o 

o 

o 

Analysts' skills would suffer 
from lack of applicable 
"real life" work 

o 

o 

o 

o 

o 

o 

o 

Support from parent 
agencies would be reduced 

Other (please specify) 

o 

o 

o 

o 

o 

o 

o 
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Emergency responder information collection 


28. Some people believe that Fusion Centers should focus on anti-terrorist analysis 
exclusively. 

Is there enough terrorist activity in your area of responsibility to support an 
exclusively terrorist work load? 

d 

zl 

29. The individual responses to this survey will remain anonymous unless you indicate 
that your responses can be attributed to your fusion center. Do you want your 
responses kept confidential? 

Q- 
O No 

Optional: Name and position 
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